The pump-segments-sdk npm package version 20.1.1 includes a postinstall hook that runs index.js upon installation. This script gathers the installer's hostname, full environment variables, platform details, outputs of system commands (whoami, uname, id, ps aux), current working directory, package.json, node_modules listing, and sensitive files such as /etc/passwd, /etc/shadow, and ~/.npmrc. It then sends this data unencrypted over HTTP to a hardcoded subdomain of oastify.com, a Burp Collaborator domain used for detecting out-of-band interactions. The package misrepresents itself as a netbsd-x64 esbuild build, which is inconsistent with the observed malicious behavior. The exfiltration of ~/.npmrc can expose npm authentication tokens, and attempts to read /etc/shadow aim to steal local password hashes.

The malicious postinstall script can lead to the exposure of sensitive system information and credentials, including npm authentication tokens and local password hashes. This compromises the security of the host system and potentially any connected services that rely on these credentials. The data is transmitted unencrypted, increasing the risk of interception. The presence of such a package in a supply chain can lead to unauthorized access and further compromise of development or production environments.

No official patch or remediation is currently documented. Users should avoid installing pump-segments-sdk version 20.1.1. Remove any installations of this package from systems and audit for potential credential exposure. Monitor for suspicious network traffic to unknown external domains such as oastify.com. Check the vendor advisory or trusted security sources for updates on remediation or package removal. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.