The qlkube npm package version 1.0.0 declares a preinstall lifecycle script that runs a curl command to a Burp Suite Collaborator subdomain upon npm install. This out-of-band interaction confirms that arbitrary code execution occurs on the installer's machine and leaks sensitive network information such as the public IP and DNS resolver. The package's main file is a stub with no legitimate functionality, consistent with malicious intent such as dependency confusion or targeted exploitation. According to the GHSA advisory, any system with this package installed should be considered fully compromised, requiring immediate secret and key rotation from a different machine. No patch or fix is currently available.

Installation of qlkube version 1.0.0 results in arbitrary code execution on the installer's machine, confirmed by an outbound request to an attacker-controlled domain. This leads to leakage of the installer's public IP address and DNS resolver information. The compromise is severe enough that the entire system should be considered fully compromised, with potential unauthorized access to secrets and keys stored on the machine. Removing the package alone may not eliminate all malicious components introduced by the attacker.

There is no official patch or fix available for this malicious package. Immediate removal of the qlkube package version 1.0.0 is recommended. All secrets and keys stored on compromised machines should be rotated immediately from a separate, trusted system. Due to the high likelihood of full system compromise, further forensic analysis and remediation may be necessary. Monitor for any suspicious activity related to this package and avoid installing untrusted or unknown npm packages.