The malicious @pluxee-connect/api-client package, published at versions 99.0.0 and 99.0.1, executes a post-installation script that gathers system identifiers such as os.hostname(), os.userInfo(), and process.version. It transmits this information unencrypted to a Burp Collaborator subdomain (oastify.com), using both HTTP requests and DNS subdomain encoding as exfiltration channels. The package itself exports minimal functionality, consistent with a dependency confusion attack where an attacker publishes a high-versioned package to a public registry to trick internal systems into installing it and leaking sensitive environment data.

Systems that install the affected versions of this package leak machine-specific information including hostname, user details, and Node.js version to an attacker-controlled server. This information disclosure can aid attackers in reconnaissance and further targeted attacks. The exfiltration occurs silently during package installation, potentially affecting developer machines and continuous integration environments that resolve this package from the public npm registry.

No official patch or fix is currently available. Users should avoid installing the @pluxee-connect/api-client package versions 99.0.0 and 99.0.1 from the public npm registry. Organizations should audit their dependency resolution processes to prevent dependency confusion attacks, such as by using scoped registries, strict version pinning, and verifying package provenance. Monitoring and blocking outbound traffic to suspicious domains like oastify.com may help detect or prevent data exfiltration.