The 'oauth-connect' npm package versions 0.1.1 and 2.0.1 include a preinstall script that runs 'node index.js' on installation. This script gathers installer-side system data such as os.hostname(), os.userInfo(), home directory, DNS server settings, and sensitive files like /etc/passwd and /etc/hosts, along with the consumer's package.json contents. It then sends this information to a malicious external server controlled by an attacker. This behavior is unrelated to the package's advertised OAuth helper functionality and represents a reconnaissance and data exfiltration payload triggered automatically during npm install.

This malicious code compromises the confidentiality of the installer's environment by exfiltrating sensitive system and configuration data to an attacker-controlled server. This can lead to reconnaissance on the victim system, potential further exploitation, and exposure of sensitive user and system information. The attack occurs silently during package installation without user consent or awareness.

No official patch or remediation is currently documented. Users should avoid installing the affected versions (=0.1.1 and =2.0.1) of the 'oauth-connect' package. Verify package integrity and source before installation. Consider using package integrity verification tools and monitoring for suspicious preinstall scripts in dependencies. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.