Malicious code in @s4yhiitestpoc/scan-https-d (npm)

The @s4yhiitestpoc/scan-https-d npm package (version 1.0.0) executes a post-install script that gathers extensive system and network information from the host machine. It collects os.hostname(), os.userInfo().username, home directory, current working directory, non-internal network interface addresses, DNS servers, and platform/architecture/release details. This data is sent as JSON via HTTPS POST to a hardcoded external endpoint (https://collector.oob.s4yhii.com/_npm-poc/beacon). Additionally, the package performs a DNS lookup against *.oob.s4yhii.com as an out-of-band signal. Although the package is self-described as a dependency-confusion proof-of-concept targeting internal namespaces, it effectively leaks sensitive host identifiers to an unauthorized third party during installation.

Sensitive host environment information is exfiltrated to an external server without user consent during package installation. This can lead to privacy violations and may aid attackers in reconnaissance or further targeted attacks. There is no indication of further exploitation or active attacks in the wild.

No official patch or remediation is indicated. Users should avoid installing this package or any packages from the @s4yhiitestpoc scope. Review and audit npm dependencies carefully before installation, especially those from untrusted or unknown sources. Consider using tools that detect malicious post-install scripts. Since this is a malicious package, removal from projects and registries is recommended.