The 'testing-d3do' npm package at version 99.9.9 is identified as malicious due to its postinstall script that collects system identifiers (os.hostname(), os.userInfo(), current working directory, external IPv4) and exfiltrates them via HTTP POST to a hardcoded subdomain under oast.fun, a known Interactsh out-of-band data collector used in reconnaissance. The package metadata suggests it is a dependency-confusion squat, designed to hijack package resolution by using a high version number and minimal metadata. This results in leakage of host environment information to a third party upon installation.

Installation of this package results in unauthorized disclosure of host environment details including hostname, user information, current directory, and external IP address to an attacker-controlled server. This data leakage can facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of code execution beyond the data exfiltration during installation, and no known exploits in the wild have been reported.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing the 'testing-d3do' package at version 99.9.9 or any similarly suspicious packages, especially those with unusual version numbers and minimal metadata. Use trusted package sources and verify package authenticity before installation. Monitor dependency sources to prevent dependency confusion attacks. Patch status is not applicable as this is a malicious package rather than a vulnerability in legitimate software.