The react-hook-use-debounce-throttle-12 npm package declares a postinstall script that runs a Node.js HTTPS request to a bare IPv4 address (8.140.205.78) on port 80 without TLS, silently swallowing errors. This network activity occurs unconditionally on every npm install, leaking the installer's IP address, install timing, and machine footprint to the operator of the remote host. The package advertises React debounce/throttle hooks but has no legitimate reason for network communication during installation. The author metadata is a generic placeholder with no valid repository, and the package name includes a numeric suffix typical of disposable or republished malicious packages. This behavior constitutes a victim-enumeration and install-tracking attack. According to the GHSA-malware source, any system with this package installed should be considered fully compromised, with immediate rotation of all secrets and keys recommended. Removal of the package does not guarantee elimination of all malicious software introduced.

Installation of this package results in a network beacon to attacker-controlled infrastructure, leaking sensitive information about the install environment. The package is considered fully compromising, potentially allowing attackers full control over the infected system. All secrets and keys on the compromised machine should be considered exposed and rotated immediately. The presence of this package indicates a high risk of persistent malicious activity beyond the package itself.

Remove the react-hook-use-debounce-throttle-12 package immediately if installed. Rotate all secrets and keys stored on the affected machine from a separate, trusted device. Because the package may have granted full control to an attacker, consider a full system audit and reinstallation from a clean state. There is no official patch or fix; avoidance and removal are the only mitigations.