The 'tfjs-inference' npm package version 1.0.0 is a malicious typosquatting package mimicking TensorFlow.js. Its postinstall lifecycle script automatically collects detailed system and environment information from the installer host and exfiltrates this data to a hardcoded external server (zl2u2d1x.instances.poc.jchunt.top) without any opt-in or user notification. Although internal comments describe the package as a security research canary, the exfiltration endpoint is controlled by the package author, making this a privacy-invasive and potentially malicious behavior. The data collection triggers immediately upon 'npm install', posing a risk to users who inadvertently install this package.

This package compromises user privacy by silently collecting and transmitting host system identifiers to an external server controlled by the package author. This unauthorized data exfiltration can lead to exposure of sensitive environment details, potentially aiding further targeted attacks or profiling. There is no indication of direct code execution impact beyond data leakage. No known exploits in the wild have been reported.

No official patch or remediation is documented for this package. Users should avoid installing 'tfjs-inference' version 1.0.0 and verify package authenticity before installation to prevent inadvertent data exfiltration. Since this is a typosquatting package, ensure correct package names are used when installing dependencies. Monitor for and remove any instances of this package if found in your environment.