The @salem_jalal/osc-components package version 1981.17.7 includes a postinstall hook that transmits installer host data such as hostname, OS platform/architecture, username, working directory, Node version, npm registry environment, and DNS server list to a remote HTTP endpoint. The main module contains an immediately invoked function expression (IIFE) that, when executed in a browser environment, collects document.cookie, all localStorage entries, the current URL, and userAgent string, sending these with credentials included to the same remote server. The package falsely identifies itself internally as @dx-ui/osc-components, indicating a dependency confusion or namespace impersonation attack. The malicious code runs unconditionally on installation and at runtime in browser contexts.

Sensitive host and user environment information is exfiltrated during package installation, potentially exposing system identifiers and environment details. When used in browser contexts, the package leaks cookies, localStorage data, and browsing context information with credentials, risking user session hijacking and privacy breaches. The namespace impersonation may cause confusion or unintended dependency resolution, increasing the risk of supply chain compromise.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the @salem_jalal/osc-components package version 1981.17.7. Audit dependencies for this package and any that may have pulled it in transitively. Consider using package integrity verification and strict namespace controls to prevent dependency confusion attacks. Monitor for updates or advisories from trusted sources regarding remediation.