The 'notafollower1' npm package versions 1.0.0 through 1.0.13 include a postinstall script that automatically runs on npm install. This script fetches AWS ECS container task metadata from the ECS_CONTAINER_METADATA_URI_V4 endpoint, including task ARNs, container names, and image names. It then exfiltrates this data via a POST request to a hardcoded ngrok URL unrelated to any legitimate publisher infrastructure. Additionally, the script inspects container image names for substrings associated with known security research operators, enabling targeted fingerprinting of sandbox or analyst environments. This behavior reveals sensitive CI/build/container environment details to a third party without user consent.

The malicious postinstall script leaks sensitive AWS ECS container metadata and environment details to an unauthorized external endpoint. This exposure can compromise the confidentiality of the deployment environment and potentially aid attackers in further targeting or evading detection. The fingerprinting of security researchers and sandbox environments suggests deliberate attempts to evade analysis and detection.

No official patch or remediation is currently documented. Users should avoid installing or using the affected versions of the 'notafollower1' package. Review and audit dependencies for malicious postinstall scripts. Consider using package integrity verification tools and restrict network egress from build and deployment environments to prevent unauthorized data exfiltration. Monitor vendor advisories for updates or official fixes.