The 'swiper_angular' npm package at version 5.9999.0 contains a preinstall.js script that runs automatically upon installation. This script gathers extensive environment and network information from the host system, including OS hostname, user information, current directory, package name, git remote domain, DNS resolver configurations, hosts file contents filtered for specific organization tokens, and external IP addresses. The collected data is concatenated into a query string and exfiltrated via HTTPS GET request to a hardcoded Interactsh subdomain known for malicious activity. This behavior is triggered without user consent and specifically targets the organization 'tbibank'. The package is classified as malicious by the OpenSSF Package Analysis project and Amazon Inspector. There is no CVSS score or vendor advisory available, and no known exploits in the wild have been reported.

The malicious code compromises user privacy and security by exfiltrating sensitive host and network information to an attacker-controlled domain. This can lead to targeted reconnaissance against the affected organization (tbibank), potentially facilitating further attacks. The automatic execution during package installation increases the risk of unnoticed data leakage. No direct code execution or system compromise beyond data exfiltration is described.

No official patch or remediation guidance is currently available. Users should avoid installing the 'swiper_angular' package version 5.9999.0. Verify package authenticity before installation and prefer official, verified package sources. Monitor for updates from the package maintainers or security advisories for remediation. Since this is not a cloud service, remediation depends on user action to avoid or remove the malicious package.