The relativity-foundation-core npm package version 6.8.2 includes a malicious preinstall script that gathers environment and system metadata (os.hostname(), USER/USERNAME environment variables, current working directory, npm_config_registry, CI environment variables, and platform) and encodes this information in base64. It then sends this encoded data via an HTTPS GET request to a Burp Collaborator subdomain controlled by an attacker, effectively exfiltrating reconnaissance data on every npm install. The package's index.js is empty, confirming that the preinstall script is the only active component. This behavior constitutes a supply chain attack through a malicious npm package.

The malicious preinstall script can leak sensitive environment and system information to an attacker-controlled server during the installation process. This reconnaissance data could be used to profile the victim's environment for further targeted attacks or exploitation. There is no indication of direct code execution beyond the preinstall script or persistence mechanisms. No known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing version 6.8.2 of relativity-foundation-core. Verify package integrity and source before installation. Consider using package integrity verification tools and monitoring for unexpected network requests during npm installs. Check the vendor or package repository for updates or official advisories regarding this malicious package.