[email protected] is a malicious npm package that runs a postinstall script during installation. This script gathers sensitive host environment information including os.hostname(), platform, architecture, Node.js version, package name, and lifecycle event. It then transmits this data via HTTP POST to a hardcoded attacker-controlled URL (https://1zrgq9h2.instances.poc.jchunt.top/localize-extract). The package name mimics the legitimate @angular/localize package and references its package.json, indicating an attempt at dependency confusion or typosquatting to trick users into installing it. This results in unauthorized data exfiltration from the installer's machine.

Sensitive host environment information is exfiltrated without user consent during package installation. This can lead to privacy violations and potentially aid attackers in further targeted attacks or reconnaissance. There is no indication of remote code execution or direct system compromise beyond data leakage. No known exploits in the wild have been reported.

Users should avoid installing [email protected] and verify package names carefully to prevent typosquatting attacks. Since this is a malicious package, removal from projects and package-lock files is recommended. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software. Users should rely on trusted package sources and consider using tools that detect malicious or suspicious packages.