Malicious code in npx-oob-package (npm)

The npx-oob-package @1.0.2 contains malicious code that collects local identifiers such as username, hostname, and platform information and exfiltrates this data via a fetch request to a hardcoded Cloudflare Workers URL. This exfiltration occurs on both CLI invocation and any require/import of the package, without user consent or opt-out. The package functions as an out-of-band beacon, consistent with dependency confusion or pentest-style reconnaissance. Security sources classify any system with this package installed or running as fully compromised, recommending immediate secret rotation and removal of the package, though removal may not guarantee full remediation.

The package leaks sensitive host and user identifiers to an attacker-controlled endpoint, potentially enabling further targeted attacks. Because the package executes code on import or CLI use, it can compromise the host system's confidentiality and integrity. The compromise is considered severe enough that all secrets and keys on the affected system should be rotated. The presence of this package indicates a full system compromise with potential persistence beyond package removal.

Immediate removal of the npx-oob-package version 1.0.2 is recommended. All secrets and keys stored on the affected system should be rotated from a different, trusted machine. Due to the high risk of full system compromise, additional forensic analysis and remediation may be necessary. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix. Users should avoid installing or using this package and audit their dependency trees for its presence.