The @offa/offa-uwk npm package versions 999.0.0 and 999.0.1 declare a postinstall hook that runs index.js. This script collects os.hostname(), os.userInfo().username, process.cwd(), and the entire process.env object, which often contains sensitive tokens such as AWS, GCP, GitHub, and npm credentials. It then sends this data via HTTPS POST to a hardcoded attacker-controlled webhook URL. A preinstall hook also writes a marker file to /home/OFFA/flag. This constitutes malicious exfiltration of environment data during package installation.

Sensitive environment variables and system information are exfiltrated to an attacker-controlled endpoint during package installation. This can lead to credential leakage and unauthorized access to cloud services, repositories, and other resources if tokens are present in environment variables. The creation of a marker file may also indicate persistence or tracking by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or using the affected versions of @offa/offa-uwk (999.0.0 and 999.0.1). Review and rotate any potentially exposed credentials or tokens if these versions were installed. Consider using package integrity verification and trusted sources to prevent installation of malicious packages.