Malicious code in memories-core-web (npm)

The 'memories-core-web' npm package version 99.0.0 declares a 'preinstall' lifecycle script in its package.json that runs a curl command to a hardcoded webhook.site URL. This command transmits the installer's hostname and username as query parameters to an external request-capture service controlled by an unknown third party. The data exfiltration occurs unconditionally on 'npm install', without user consent or verification of the destination. The webhook.site endpoint is a generic collector service, not affiliated with the package publisher, indicating malicious intent embedded in the package.

Installation of the affected package version results in leakage of sensitive host identifiers (hostname and username) to an unauthorized third party. This can lead to privacy violations and potential reconnaissance for further attacks. There is no indication of further exploitation beyond this data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing 'memories-core-web' version 99.0.0. Inspect package.json scripts before installation and consider using package integrity verification tools. Monitor for updates or advisories from the package publisher or npm registry regarding this issue.