Malicious code in @outmarket/utils (npm)

The @outmarket/utils npm package declares a postinstall lifecycle script that runs automatically during npm install. This script uses hex-encoded property names to obscure calls to Node.js standard APIs such as os.hostname() and os.userInfo().username. It then issues an HTTP GET request to a hardcoded IPv4 address (http://208.87.128.25:8888) including the hostname and username as query parameters. The package is described as a dependency-confusion proof-of-concept, but the on-install behavior effectively leaks host identity information to an untrusted external endpoint. The obfuscation is intended to evade detection rather than serve a legitimate purpose.

Any user or system that installs the affected versions of @outmarket/utils (9.9.9, 9.9.10, 9.9.11) will have their hostname and username information transmitted in cleartext to an unknown external IP address. This leakage of host identity information can facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of additional payloads or direct system compromise beyond this data exfiltration.

No official patch or remediation is currently documented. Users should avoid installing or updating to the affected versions (=9.9.9, =9.9.10, =9.9.11) of the @outmarket/utils package. Verify package provenance and consider using package integrity verification or internal package registries to prevent dependency confusion attacks. Monitor for and remove any installations of these versions. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.