The stillm4ddpocs-rtest-alpha npm package declares a preinstall hook in its package.json that runs an index.js script during npm install. This script gathers the installer's local IPv4 address, public IP (via multiple external services), DNS resolver IP, hostname, OS username, home directory, current working directory, and metadata from the parent project's package.json (name, author, repository, homepage). It then exfiltrates this information as JSON to a hardcoded callback domain (da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun) using three channels: HTTP POST on port 80, HTTPS POST on port 443, and DNS TXT queries with hex-encoded payload chunks designed to evade egress filtering. The package's self-description as 'authorised security research' does not restrict execution, resulting in automatic data transmission on install. The versioning and naming suggest this is a dependency confusion probe rather than a benign package.

Sensitive environment and project information is exfiltrated without user consent during package installation. This can lead to privacy violations and potential reconnaissance for further attacks. The use of multiple exfiltration channels, including DNS covert channels, indicates an attempt to bypass network egress filtering, increasing the risk of unnoticed data leakage.

No official patch or remediation is indicated in the provided data. Users should avoid installing the affected versions (=999.9.9 and =999.9.10) of stillm4ddpocs-rtest-alpha. Review and audit dependencies for suspicious preinstall scripts. Implement network monitoring for unusual DNS queries and outbound HTTP/HTTPS traffic to unknown domains. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.