The kraken-ui package version 999.0.0 is a malicious npm package designed as a dependency confusion proof of concept. When loaded, its main entry point imports several modules and collects sensitive information including hostname, username, home directory, installation path, DNS servers, and full package.json contents. It then sends this data via HTTPS POST to an attacker-controlled out-of-band server. This behavior triggers automatically upon module load, potentially leaking internal system and network information. The package is published to the public npm registry to override an internal package, enabling attackers to capture identifying information from systems that resolve this version.

Any system that installs or runs kraken-ui version 999.0.0 is considered fully compromised. The malicious package leaks sensitive host and user information to an attacker-controlled server, potentially exposing internal DNS topology and environment details. This can lead to unauthorized access and control over the affected system. All secrets and keys stored on the compromised system should be rotated immediately from a separate, trusted machine. Removing the package alone may not eliminate all malicious artifacts or backdoors installed as a result of this compromise.

No official patch or fix is available. Immediate removal of kraken-ui version 999.0.0 from all systems is required. Rotate all secrets and keys that may have been exposed, using a different, uncompromised system. Review internal package resolution configurations to prevent dependency confusion attacks by ensuring internal packages are not overridden by public registry versions. Monitor for any signs of persistent compromise and consider full system reimaging if necessary.