The 'test8999-auth' npm package version 1.0.1 includes a preinstall script that runs index.js during 'npm install'. This script gathers host identity information such as hostname, platform, architecture, OS release, CPU details, and shell command outputs ('whoami', 'id', 'pwd', 'uname -a'). It then sends this data over plain HTTP to a hardcoded Burp Collaborator subdomain, indicating data exfiltration. The package's self-dependency declaration and generic naming suggest it is part of a dependency confusion probe. The OpenSSF Package Analysis and other sources classify this package as malicious due to its communication with a malicious domain and execution of commands linked to malicious behavior.

Any system with 'test8999-auth' version 1.0.1 installed is considered fully compromised. The attacker gains access to sensitive host information and potentially full control of the system. All secrets and keys stored on the compromised machine should be rotated immediately from a separate, trusted system. Removal of the package does not guarantee elimination of all malicious artifacts or backdoors introduced during installation.

Immediate removal of the 'test8999-auth' package version 1.0.1 is recommended. All credentials and secrets on the affected system should be rotated from a different, uncompromised device. Due to the potential full compromise, consider rebuilding the affected system from a known good state. No official patch or fix is available; the package itself is malicious and should be avoided.