@sudoughnym/[email protected] includes lifecycle scripts (preinstall.js and postinstall.js) that execute automatically on installation. These scripts gather detailed environment and host information such as os.hostname(), process.cwd(), pid, node version, platform, process.env.USER, the first ten environment variable names, and the total count of environment variables. This collected data is POSTed as JSON to a third-party webhook URL not affiliated with the package publisher. The package's high version number is intended to cause internal build systems to resolve to this malicious public package instead of a private internal package named 'enviro'. This results in leakage of host identity and environment variable structure, potentially exposing secret variable names to attackers on every install.

Any build or developer machine that installs @sudoughnym/[email protected] will leak host identity and environment metadata, including potentially sensitive environment variable names, to an attacker-controlled external endpoint. This exposure can lead to information disclosure that may facilitate further attacks or compromise of secrets. The malicious code executes automatically during installation without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is confirmed, avoid installing or resolving to @sudoughnym/[email protected]. Review and restrict package sources to trusted registries to prevent dependency confusion attacks. Remove any instances of this package from build and developer environments and audit environment variables for sensitive information exposure.