The malicious npm package '@opap/player-kyc-widget' version 3.999.999 runs a postinstall script that automatically executes upon 'npm install'. This script collects system identifiers and sends them to a hardcoded Burp Collaborator subdomain via two channels: an HTTPS GET request with a base64-encoded payload in the query string, and a DNS lookup with a hex-encoded fingerprint split into labels. The DNS channel acts as a covert exfiltration method that can bypass HTTP egress restrictions. This package is a canonical example of a dependency confusion attack, where a public package mimics a private internal package to trick internal build systems into installing it.

The malicious package can leak sensitive host information such as hostname, username, current directory, platform, and architecture to an attacker-controlled domain. This data exposure can aid attackers in profiling the victim environment for further attacks. The use of dual exfiltration channels, including a covert DNS channel, increases the likelihood of successful data leakage even in restricted network environments.

No official patch or remediation is currently documented. Users should avoid installing the '@opap/player-kyc-widget' package version 3.999.999 from the public npm registry. Verify the authenticity of packages and scopes before installation, especially for packages with suspiciously high version numbers or unknown provenance. Monitor for and remove any installations of this malicious package. Check vendor advisories or trusted security sources for updates or fixes regarding this package.