The nativescript-swisspost-imagepicker npm package version 52.31.0 includes a preinstall script that reads the installer's working directory name and sends it as a JSON payload to a hardcoded external URL (https://deepbounty.dd06-dev.fr/cb/d27071f6-8aa6-43b9-98be-0caf9803fba5). This action leaks internal project identifiers, confirming the existence and naming of private packages, effectively enabling an attacker to map organizations using this package. The package is a dependency confusion attack vector masquerading as a security proof-of-concept but results in unauthorized data exfiltration. The package installation compromises the host, potentially granting full control to the attacker. The advisory from ghsa-malware states that any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation from a clean environment.

Installation of this package results in the silent exfiltration of internal project names to an attacker-controlled server, leaking sensitive organizational information. The attacker may gain full control over the compromised system, making all stored secrets and keys potentially exposed. The compromise is severe enough that removal of the package alone does not guarantee eradication of malicious presence, necessitating a full security incident response including secret rotation.

No official patch or fix is currently available. Users should immediately remove the nativescript-swisspost-imagepicker package version 52.31.0 from their environments. Treat any system with this package installed as fully compromised. Rotate all secrets and keys from a separate, uncompromised system. Conduct a thorough security review and incident response to identify and remediate any persistent malicious activity resulting from the compromise.