The 'messenger-style' npm package version 1.0.1 includes a malicious preinstall hook that runs 'node index.js' during installation. This script gathers host identifiers including the operating system hostname, the current user's username, home directory path, DNS server information, and reads sensitive system files (/etc/passwd and /etc/hosts). The collected data is sent over HTTPS to a hardcoded attacker-controlled domain (pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com), which is a Burp Collaborator out-of-band interaction endpoint. The package name suggests messaging functionality, but no such features exist; the sole purpose is reconnaissance and data exfiltration.

The malicious package compromises the confidentiality of the host system by exfiltrating sensitive system and user information during installation. This can lead to further targeted attacks or system compromise if the attacker leverages the collected data. There is no indication of direct code execution beyond the preinstall script or persistence mechanisms, but the data leakage itself poses a significant privacy and security risk.

No official patch or remediation is available for this package version. The package should be considered malicious and avoided entirely. Users and organizations should audit their dependencies to ensure 'messenger-style' version 1.0.1 is not installed. Remove the package if found and investigate any potential data exposure. Use trusted sources and verify package integrity before installation.