The npm package [email protected] contains a postinstall script that runs automatically upon installation. This script collects sensitive environment details such as the installer's OS username, hostname, current working directory, and non-internal IPv4 addresses. It then transmits this information as JSON via an HTTPS POST request to a hardcoded external webhook URL. The package is styled to resemble a private internal package but is published publicly at a high version number with no author, description, or license metadata. This behavior is characteristic of dependency-confusion reconnaissance, aiming to detect build systems that resolve private package names to public registries.

The package leaks sensitive environment information from the system where it is installed, including usernames, hostnames, working directories, and network addresses, to an external attacker-controlled endpoint. This information disclosure can aid attackers in profiling targets for further attacks or exploitation. There is no indication of direct code execution beyond the postinstall script or further payload delivery.

No official patch or remediation is indicated for this package. The best mitigation is to avoid installing this package and audit dependencies to prevent accidental installation of malicious or typosquatted packages. Use scoped package names carefully and verify package sources before installation. Since this is a reconnaissance package, removing it and preventing its installation will stop data leakage.