The 'subapp-pkg-util' npm package versions 99.0.0 and 99.0.1 includes a postinstall hook that runs a script collecting host identifiers (os.hostname(), os.userInfo(), os.platform(), OS release) and enriches this data with public IP and geo/ISP information via external APIs. This data is then POSTed to a hardcoded Burp Collaborator subdomain at oastify.com, indicating command and control communication. The package is flagged as malicious by multiple sources including Amazon Inspector, GHSA malware database, and OpenSSF Package Analysis. It is described as a dependency-confusion takeover proof-of-concept but effectively compromises any system on which it is installed.

Any system with this package installed should be considered fully compromised. The attacker gains access to sensitive host information and potentially full control of the system. All secrets and keys stored on the compromised system should be rotated immediately from a secure, unaffected environment. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

Remove the 'subapp-pkg-util' package immediately if installed. Rotate all secrets and keys that may have been exposed from a different, secure system. Conduct a thorough investigation and remediation of the affected host as full compromise is likely. No official patch or fix is available; the package itself is malicious and should not be used.