The malicious npm package @sflyinc-knapsack/[email protected] executes code on load that collects host identifiers such as hostname, user info, home directory, DNS configuration, package.json metadata, and directory path. It then sends this data via HTTPS POST to a Burp Collaborator subdomain controlled by an attacker. The package is published under a scope mimicking an internal Shutterfly namespace to win npm version resolution against the legitimate private package, enabling dependency confusion attacks. Any system that installs or runs this package is considered fully compromised, with potential exposure of all stored secrets and keys.

Systems that install or run this package leak sensitive host and package metadata to an attacker-controlled endpoint, resulting in full compromise of the affected computer. All secrets and keys stored on the compromised system may be exposed, requiring immediate rotation. The attacker may have persistent control beyond the presence of the package itself, making removal insufficient to guarantee remediation.

No official patch or fix is available. The package should be removed immediately from all affected systems. All secrets and keys stored on compromised systems must be rotated from a separate, trusted environment. Due to the potential full compromise, additional forensic analysis and remediation steps may be necessary to ensure complete eradication of malicious code.