The @nextco/utils package version 5.0.0 includes a malicious payload that triggers immediately when the module is required. The payload gathers detailed host environment information such as hostname, username, current working directory, OS and architecture details, Node.js version, and environment variable names. This information is encoded and transmitted over plain HTTP to a domain unrelated to the package publisher, enabling attackers to gain reconnaissance data useful for subsequent targeted attacks like credential theft. The malicious behavior occurs without user consent or opt-out mechanisms.

This malicious code compromises host confidentiality by exfiltrating sensitive environment information to an attacker-controlled server. The collected data can facilitate further targeted attacks, including credential theft and system compromise. Because the data is sent unencrypted, it also risks interception. The compromise occurs simply by loading the module, making any dependent project vulnerable.

No official patch or remediation is currently documented. Users should immediately avoid using @nextco/utils version 5.0.0 and remove it from their projects. Verify dependencies for this package and replace or remove it. Monitor for updates or advisories from the package publisher or npm registry for official fixes or guidance. Until then, do not load or require this package version.