The 'message-compiler' npm package version 9.2.0 contains malicious code in its preinstall script ('node vishu.js') that runs automatically upon installation. This script retrieves the installer's public IP address using api.ipify.org, reads continuous integration environment variables (such as CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID), and sends these details via HTTPS GET to a hardcoded webhook.site URL controlled by the attacker. It also performs a DNS lookup on a subdomain derived from the installer's hostname under the oastify.com domain, which is used for exfiltration via DNS. The package is a typosquat of the legitimate scoped package '@intlify/message-compiler' and contains no legitimate functionality beyond this beaconing behavior.

This malicious package can leak sensitive information about the environment where it is installed, including the public IP address, CI environment variables, and the hostname of the machine. This data exposure could aid attackers in reconnaissance and further targeted attacks. There is no indication of direct code execution beyond the exfiltration behavior, and no known exploits in the wild have been reported.

No official patch or remediation is documented for this malicious package. The best mitigation is to avoid installing the 'message-compiler' package version 9.2.0, especially if it is not the legitimate '@intlify/message-compiler' package. Users should verify package names carefully to avoid typosquatting attacks and consider using package integrity verification tools. Monitor for unexpected network connections during npm installs and remove any instances of this package if found.