The mamadoos-test npm package version 10.0.0, 10.1.0, and 11.0.0 includes a preinstall lifecycle hook that runs a curl command to a remote URL embedding the installer's OS username, hostname, and current working directory. This occurs automatically on npm install without opt-in, leaking sensitive environment identifiers. The package's declaration as a dependency suggests it may be used as a dependency confusion probe to capture internal host and CI environment details. This exfiltration can aid attackers in locating internal hosts, mapping CI environments, and fingerprinting build paths.

Unconsented exfiltration of sensitive host environment information (username, hostname, working directory) to a third-party endpoint occurs during package installation. This information leakage can facilitate follow-on attacks such as internal network reconnaissance and targeted exploitation. No direct code execution or system compromise beyond information leakage is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or updating to versions 10.0.0, 10.1.0, and 11.0.0 of mamadoos-test. Review your dependency tree for this package and consider removing or replacing it. Monitor for updates from the package maintainer or npm security advisories for remediation.