The stillm4ddpocs-rtest-bravo npm package declares a preinstall script that runs 'node index.js' automatically during npm install. The script gathers environment and project metadata such as hostname, username, home directory, local IPv4, public egress IP (queried from multiple external services), and the consuming project's package.json fields (name, author, repository, homepage). This information is sent to a hardcoded external collector endpoint via HTTPS POST and simultaneously encoded and exfiltrated through DNS queries to a fallback domain. This behavior occurs without installer consent and exposes potentially sensitive internal project identifiers to an external third party. The package's self-description as a dependency-confusion PoC does not mitigate the unauthorized data exfiltration.

Sensitive environment and project metadata are exfiltrated to an external third-party server without user consent. This can lead to exposure of internal project details, user environment information, and network identifiers. The dual exfiltration channels (HTTPS and DNS) increase the likelihood of successful data leakage even in environments with outbound HTTP restrictions. There is no indication of further payloads or direct system compromise beyond information disclosure.

No official patch or remediation is currently available. Users should avoid installing or using the stillm4ddpocs-rtest-bravo package versions 999.9.9 and 999.9.10. Review and audit npm dependencies for unexpected preinstall scripts or network communications. Employ network monitoring to detect unusual DNS queries or outbound HTTPS requests to unknown domains. Consider restricting DNS and HTTP egress to trusted destinations. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.