The test890-auth npm package (version 1.0.0) includes a preinstall script in index.js that collects installer-side identifiers such as home directory path, hostname, username, DNS server configurations, and the entire package.json content of the consuming project. This information is exfiltrated over HTTPS to a hardcoded external collector host (wddbracmbzlaffkl9eivxzsvamgd43ss.oastify.com). The package declares itself as a dependency, matching a dependency-confusion probe pattern aimed at internal registries. It contains no functional code beyond this exfiltration behavior. The presence of this package indicates a full compromise of the affected system.

Any system with test890-auth version 1.0.0 installed is considered fully compromised. Sensitive information, including environment identifiers and project metadata, is exfiltrated to an attacker-controlled server. The attacker may have gained full control over the system, potentially exposing all stored secrets and keys. Immediate secret rotation is required from a trusted environment. Removal of the package alone does not guarantee elimination of all malicious artifacts.

Remove the test890-auth package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted system. Because the package may have granted full control to an attacker, assume persistent compromise and perform a thorough incident response. No official patch or fix is available; remediation requires removal and secret rotation.