This threat involves a malicious npm package that declares a preinstall script in its package.json. The script executes index.js on installation, which uses child_process.exec to gather sensitive host information including hostname, current working directory, username, a package marker, and the public IP address (retrieved via curl to ifconfig.me). The collected data is hex-encoded and exfiltrated through DNS queries to subdomains of snurkeburk.com, effectively creating a DNS tunnel that circumvents typical HTTP egress filtering controls. This behavior results in unauthorized data leakage to an attacker-controlled DNS namespace.

Installation of the affected package versions results in unauthorized exfiltration of host identifiers and the public IP address to an attacker-controlled DNS domain. This can lead to privacy breaches and potential reconnaissance for further attacks. The exfiltration method bypasses HTTP filtering by using DNS tunneling, making detection and blocking more challenging.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid installing or using the affected package versions (=1.999.0 and =2.999.0). Monitor package sources carefully and consider using package integrity verification or trusted registries to prevent installation of malicious packages.