The tme-error package was published to npm by a user 'click2ai' as part of a dependency confusion reconnaissance campaign targeting organizations using a 'tme' internal namespace. The package's preinstall hook runs automatically during npm install, executing a script that initializes the @sentry/node client with a hardcoded attacker-controlled DSN and sends telemetry including the installer's public IP (resolved via Cloudflare), hostname, OS username, and Node.js runtime metadata to the attacker's Sentry project. This data exfiltration occurs without user consent and before application code runs. The package also exports an init() function that, if called without a DSN, routes error reports to the attacker's Sentry project, misleading consumers. The install-time payload is identical across all packages published by this actor, differing only in package name and target DSN. The affected version is exactly 2.8.42. Security advisories warn that any system with this package installed should be considered fully compromised, with immediate secret rotation recommended.

Installation of this malicious package results in unauthorized exfiltration of sensitive host telemetry including public IP address, hostname, OS username, and runtime environment metadata to an attacker-controlled Sentry endpoint. This compromises confidentiality and may enable targeted follow-up attacks. The package also hijacks error reporting by redirecting captured exceptions to the attacker's Sentry project if consumers use the init() function without specifying their own DSN, potentially leaking application error data. Systems with this package installed are considered fully compromised, and secrets stored on those systems should be rotated immediately. Removal of the package alone does not guarantee full remediation.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the tme-error package version 2.8.42 from all affected systems. Because the package executes code at install time that exfiltrates sensitive data and may compromise the system, all secrets and keys stored on affected computers should be rotated from a different, trusted machine. Monitor for any signs of further compromise. Avoid installing packages from untrusted or suspicious sources, especially those mimicking internal namespaces. Verify package provenance before installation.