The kraken-ui package at version 999.0.0 is a malicious npm package that implements a dependency confusion attack. Upon loading, it gathers detailed system and user information such as os.hostname(), os.userInfo().username, os.homedir(), __dirname, dns.getServers(), and the entire package.json file. This data is exfiltrated via an HTTPS POST request to a Burp Collaborator OAST subdomain controlled by the attacker. The package is published publicly to override an internal package of the same name, causing build systems or installers that resolve this version to leak sensitive internal information. The malicious code executes automatically when the package's main entry point is loaded, resulting in full system compromise.

Systems that install or run kraken-ui version 999.0.0 are fully compromised. Sensitive host and user information, including internal DNS topology and package metadata, is leaked to an attacker-controlled server. This can lead to further exploitation, unauthorized access, and potential lateral movement within affected environments. All secrets and keys stored on compromised systems are at risk and must be rotated immediately from a secure, uncompromised system.

No official patch or fix is available for this malicious package version. Immediate removal of kraken-ui version 999.0.0 is required. All secrets and keys on affected systems should be rotated from a different, trusted environment. Because the package grants full control to an attacker, assume the system is compromised and conduct a thorough incident response. Avoid installing packages with suspicious or unusually high version numbers that may indicate dependency confusion attacks.