magika-js is a malicious npm package designed to impersonate Google's magika library by typosquatting its name. Upon installation, its postinstall lifecycle script automatically collects detailed system and environment information from the installer machine and transmits this data to a hardcoded external URL (https://ucjtw03t.instances.poc.jchunt.top/magika-js). This transmission occurs without user opt-in and serves no documented legitimate purpose, indicating a privacy breach and potential reconnaissance activity. The package references the legitimate Google magika GitHub repository to reinforce its impersonation and deceive users.

The malicious postinstall script compromises user privacy by exfiltrating system and environment details to an attacker-controlled server. This data leakage can facilitate further targeted attacks or profiling of affected systems. There is no indication of direct code execution beyond data exfiltration, and no known exploits in the wild have been reported. However, the presence of such a package in a supply chain can undermine trust and security of dependent projects.

Users and developers should avoid installing the magika-js package, especially version 4.1.1, which is known to contain the malicious postinstall script. Since no official patch or remediation is indicated, the best mitigation is to remove this package from dependencies and use the legitimate Google magika library instead. Monitor package sources carefully to avoid typosquatting attacks. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.