The [email protected] npm package includes a preinstall script that runs automatically on npm install. This script collects identifying host data and sensitive system files, then sends this information to a hardcoded Burp Collaborator subdomain controlled by an attacker. The package lacks any other functionality and is likely intended as a dependency confusion or out-of-band beacon attack. This results in unauthorized data exfiltration from the host system upon installation.

Installing [email protected] results in the leakage of sensitive system information and user environment details to an attacker-controlled external server. This compromises host confidentiality and may facilitate further targeted attacks or reconnaissance. No direct code execution beyond the preinstall script is indicated, but the data exposure is significant.

No official patch or remediation is currently available for [email protected]. Users and organizations should avoid installing this package. Review and remove any instances of [email protected] from dependency trees. Employ supply chain security best practices such as verifying package provenance and using trusted registries. Monitor for any updates from the package maintainer or npm advisory for potential fixes.