The npm package @offa-uwk/offa-uwk version 999.0.6 includes a postinstall script that gathers host information such as hostname, username, and current working directory, and sends this data via HTTPS to a hardcoded webhook.site URL. Immediately after sending this beacon, the script attempts to shut down the host using 'shutdown -h now' or 'systemctl poweroff'. A preinstall script also creates a marker file at /home/OFFA/flag, outside the package directory. This package metadata and behavior indicate it is a malicious package designed to exfiltrate data and disrupt the host system.

The malicious package can exfiltrate sensitive host information to an external server and forcibly power off the affected system, causing potential data loss and operational disruption. The creation of a marker file outside the package directory may indicate persistence or tracking attempts. There is no indication of known exploits in the wild at this time.

No official patch or remediation is available for this package version. The package should be considered malicious and avoided. Users should not install @offa-uwk/offa-uwk version 999.0.6. Remove the package if already installed and verify system integrity. Monitor for unexpected shutdowns and unauthorized network connections. Since this is a malicious package, the best mitigation is to avoid installation and remove any instances.