The @rockawayx/utils package version 0.0.1 is a malicious npm package that exploits dependency confusion by squatting the unclaimed @rockawayx scope. It includes a preinstall script in package.json that runs notify.js, which collects system identifiers (hostname, username, platform, timestamp) and sends them as JSON to a hardcoded IPv4 address (https://2.25.140.71:8443/rockawayx/depconf-poc) with TLS verification disabled. This exfiltration occurs silently during installation, affecting any build that resolves @rockawayx/* packages from the public registry. Although the README claims the package is for authorized security research, the behavior is consistent with dependency-confusion attacks, compromising any consumer pipeline that installs it.

Any computer that installs or runs this package is considered fully compromised. The attacker gains access to sensitive host identifiers and potentially full control over the system. All secrets and keys stored on the compromised machine should be rotated immediately from a secure, unaffected device. Removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Immediate removal of the @rockawayx/utils package version 0.0.1 is recommended. All secrets and credentials on affected systems should be rotated from a different, trusted machine. Since no official fix or patch is available and the package is malicious by design, avoid installing packages from untrusted or unclaimed npm scopes. Monitor dependency sources carefully to prevent dependency confusion attacks.