The package @offa-uwk/offa-uwk version 999.0.6 includes a postinstall script that gathers host information such as hostname, username, and current working directory, then sends this data via HTTPS POST to a hardcoded webhook.site URL. Immediately after sending this beacon, the script attempts to forcibly power off the host using 'shutdown -h now' or 'systemctl poweroff'. Additionally, a preinstall script writes a marker file at /home/OFFA/flag outside the package directory. This indicates intentional malicious behavior embedded in the package installation process.

The malicious postinstall script leaks host identifiers to an external collector, potentially exposing sensitive environment information. The forced shutdown disrupts system availability and could cause data loss or service interruption. The creation of a marker file outside the package directory may indicate persistence or tracking attempts. There is no indication of further exploitation or remote code execution beyond these actions.

No official patch or remediation is indicated. Users should avoid installing this specific package version (=999.0.6). Since this is a malicious package artifact, the best mitigation is to remove it from any environment and avoid using untrusted or suspicious npm packages. Monitor for any unexpected shutdowns or presence of the /home/OFFA/flag file as indicators of compromise.