The 'test899-auth' npm package version 1.0.1 includes a preinstall script that gathers sensitive system information such as hostname, platform, OS release, user identity, and system details. This data is base64-encoded, split into DNS labels, and exfiltrated through DNS queries to a hardcoded subdomain controlled by an attacker, effectively bypassing HTTP egress filtering. The package.json declares an unpinned self-dependency, consistent with a malicious or research probe package. Multiple sources, including Amazon Inspector, GHSA malware database, and OpenSSF Package Analysis, classify this package as malicious due to its behavior and communication with a known malicious domain.

Any system that installs or runs this package is considered fully compromised. Sensitive information about the host and user is leaked to an attacker-controlled domain. The attacker may have gained persistent control, and secrets or keys stored on the compromised system should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors.

Immediate removal of the 'test899-auth' package version 1.0.1 is recommended. All secrets, credentials, and keys stored on the affected system should be rotated from a different, trusted machine. Due to the high likelihood of full system compromise, a full system audit and potential rebuild may be necessary. No official patch or fix is available; the package itself is malicious and should be avoided.