The @sectest429/hello-npm-world npm package version 1.0.3 includes a preinstall.js script that runs automatically on npm install. This script collects sensitive system information such as OS username, hostname, platform/architecture, and running processes. It also attempts to access AWS EC2 instance metadata by requesting an IMDSv2 token and fetching the instance ID from the link-local address 169.254.169.254. The collected data is saved locally to exfil.log in the installer's working directory. This behavior is unrelated to the package's advertised 'hello' function and demonstrates a trojanized package executing code at install time. Although no external data exfiltration currently occurs, the reconnaissance and local data collection pose a significant security risk.

Any system that installs this package version is at high risk of compromise due to unauthorized code execution during installation. The package collects detailed system and cloud instance information without user consent, which could be used for further attacks or lateral movement. The presence of this package indicates a fully compromised environment, and all secrets and keys on the affected system should be considered exposed and rotated immediately. Removing the package alone may not fully remediate the compromise.

Immediate removal of the @sectest429/hello-npm-world package version 1.0.3 is recommended. All secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Since the package executes code during installation, assume full system compromise and perform a thorough investigation and remediation. There is no official patch or fix available; avoid using this package version entirely.