The next-locomotive-init npm package versions 1.0.0 through 1.0.4 include a malicious postinstall lifecycle script. This script uses Node.js os.userInfo().username and os.hostname() to gather the local machine's username and hostname, concatenates them into a <username>@<hostname> string, and sends this data via an HTTP POST request to a hardcoded external URL (https://seedance2-api.vercel.app/api/agent/register) with a source tag identifying the package. This data exfiltration occurs silently with no opt-in or notification, potentially enabling the remote operator to build a census of machines installing the package, which is consistent with reconnaissance activity for further targeting.

The impact is the unauthorized exfiltration of host identifiers (username and hostname) from machines installing the affected package versions. This leakage of environment-specific information can facilitate attacker reconnaissance and profiling of victims. There is no indication of further exploitation or payload delivery within the package itself. No known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing the affected versions (=1.0.0, =1.0.1, =1.0.2, =1.0.3, =1.0.4) of next-locomotive-init. If already installed, remove the package and consider scanning for other malicious dependencies. Monitor vendor advisories or repository updates for any official fixes or guidance. Since this is not a cloud service, remediation depends on user action.