The '@ks-radar/radar' npm package at version 22.0.0 includes a preinstall.js script that reads a hex-encoded command from preinstall.json, decodes it, and executes it via child_process.exec. The executed command uses curl to POST reconnaissance data such as the output of 'whoami', current working directory, hostname, and contents of '/etc/passwd' and '/etc/hosts' to a malicious endpoint hosted on pipedream.net, which is attacker-controlled and unrelated to the package publisher. This behavior is considered malicious as it exfiltrates sensitive system information during installation, hidden by hex encoding to avoid detection.

The malicious preinstall script exfiltrates sensitive system information from the host machine to an attacker-controlled server. This includes user identity, system hostname, current directory, and contents of critical system files. Such data leakage can facilitate further attacks, compromise system confidentiality, and undermine trust in the software supply chain.

Users should avoid installing '@ks-radar/radar' version 22.0.0. Since no patch or remediation is indicated, the safest approach is to remove this package from projects and replace it with a trusted alternative. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals. Until then, do not use this package version.