The malicious npm package @sflyinc-knapsack/shutterfly-react (version 999.0.0) executes code on require/load that collects host identifiers such as os.hostname(), os.userInfo(), os.homedir(), DNS server configuration, package.json metadata, and __dirname. It then exfiltrates this data via HTTPS POST to a Burp Collaborator subdomain controlled by an attacker. The package is published under a scope mimicking an internal Shutterfly namespace, designed to override the legitimate private package during npm version resolution. This results in leakage of sensitive host and internal package metadata to an attacker-controlled endpoint. The package description identifies it as a dependency-confusion proof-of-concept, but the live artifact executes maliciously against any consumer that resolves it.

Any computer with this package installed or running should be considered fully compromised. The attacker gains access to sensitive host information and internal metadata, which can lead to further compromise. All secrets and keys stored on the affected computer should be rotated immediately from a separate, trusted device. Removing the package alone does not guarantee removal of all malicious software or attacker persistence.

Remove the @sflyinc-knapsack/shutterfly-react package version 999.0.0 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or thoroughly investigating the affected host to ensure complete remediation. There is no official patch or fix available; mitigation relies on removal and secret rotation.