The 'library-explorer' npm package version 25.2.1 declares a preinstall script that runs 'index.js' upon installation. This script gathers extensive host identity information including OS details, user information, CPU and memory data, and executes system commands like 'whoami' and 'id'. The collected data is sent via HTTP POST to a hardcoded Burp Collaborator subdomain, indicating malicious intent consistent with a dependency-confusion or internal-name reconnaissance beacon. The package itself lacks legitimate functionality and is likely staged to automatically exfiltrate data during installation.

Installation of this package results in unauthorized collection and exfiltration of sensitive host system and user identity information to an external attacker-controlled server. This compromises host confidentiality and could facilitate further targeted attacks or reconnaissance. There are no known exploits in the wild, but the high severity reflects the potential for sensitive data leakage.

No official patch or remediation is documented. Users should avoid installing version 25.2.1 of 'library-explorer'. Verify package authenticity before installation and consider using package integrity verification tools. Monitor for and remove any installations of this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.