Malicious code in @s4yhiitestpoc/r3-https (npm)

The malicious npm package @s4yhiitestpoc/r3-https (version 1.0.0) executes a post-install script that gathers detailed host information such as hostname, user identifiers, platform details, network interfaces, DNS servers, and container/runtime indicators. It also extracts the consuming project's package.json metadata by traversing parent directories. The collected data is exfiltrated via HTTPS POST requests and DNS lookups to a fixed external endpoint (collector.oob.s4yhii.com). This data leakage reveals private project identities and internal package naming, facilitating dependency confusion attack pipelines. The endpoint is hardcoded and not configurable, with no opt-out mechanism.

The package leaks sensitive environment and project metadata to an external third party during installation, potentially exposing private project information and internal network details. This can aid attackers in crafting targeted dependency confusion attacks or other supply chain compromises. There is no indication of direct code execution beyond the data exfiltration, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing the affected package version (=1.0.0). Since the endpoint is hardcoded and no opt-out exists, removing or replacing the package is the primary mitigation. Monitor for updates from the package maintainer or npm advisories for any official fixes.