The 'sn-flow-client' npm package declares a preinstall script that runs index.js during installation. This script collects system information including hostname, platform, architecture, home directory, user info, and command outputs such as 'whoami' and 'id'. It then sends this data as JSON to a malicious external endpoint hosted on an attacker-controlled Burp Collaborator domain. The package metadata is empty or misleading, indicating no legitimate purpose and suggesting it is used for malicious reconnaissance or dependency confusion attacks. The OpenSSF Package Analysis project identified this package as malicious based on its behavior and communication with a known malicious domain.

Installing the affected versions of 'sn-flow-client' results in unauthorized disclosure of sensitive host and user identity information to an attacker-controlled server. This compromises privacy and may facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of additional payloads or direct system compromise beyond data exfiltration.

No official patch or remediation is currently documented. Users and organizations should avoid installing the 'sn-flow-client' package versions 10.10.10, 20.5.1, and 1.0.2. Review dependency trees to ensure this package is not included transitively. Monitor for and remove any instances of this package from projects. Since no fix is available, prevention of installation is the primary mitigation.