The stillm4ddpocs-demo-sprocket npm package at version 999.9.12 declares a preinstall script that runs index.js on installation. This script gathers detailed environment and project metadata and transmits it to a hardcoded callback domain via multiple channels, including HTTPS POST, HTTP POST, and a covert DNS exfiltration method that encodes data in DNS queries to evade network filtering. The package's README confirms the use of a high version number to exploit dependency confusion, causing unintended installation of this malicious package when internal resolvers fail. This results in unauthorized data leakage without user opt-in.

Sensitive host identity and internal project metadata are exfiltrated to a third-party server without user consent. This can lead to privacy violations, information disclosure about internal projects, and potential reconnaissance for further attacks. The use of covert DNS channels indicates an attempt to bypass network egress controls, increasing the risk of unnoticed data leakage.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing the stillm4ddpocs-demo-sprocket package at version 999.9.12 from public npm registries. Organizations should audit their dependency resolution configurations to prevent dependency confusion attacks by ensuring internal packages are properly scoped and prioritized. Monitoring and blocking outbound connections to suspicious domains such as da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun can help detect or prevent data exfiltration attempts.