The 'tn-advertisement' npm package version 5.0.0 includes malicious code in its main entry file (postinstall.js) that, when loaded, performs an unconditional HTTP GET request to a unique subdomain of oastify.com, a Burp Suite Collaborator out-of-band testing infrastructure. This request leaks the installer's public IP address and DNS resolver information to the attacker controlling the subdomain, confirming code execution on the victim's machine. The package lacks any advertised legitimate functionality and is indicative of a dependency-confusion reconnaissance payload used to verify successful supply-chain compromise before further exploitation. Due to this behavior, any system with this package installed or running should be considered fully compromised.

Systems with 'tn-advertisement' version 5.0.0 installed or running are fully compromised as the package executes code that leaks sensitive network information to an attacker-controlled server. This exposure confirms attacker code execution on the victim machine, potentially allowing further malicious actions. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Simply removing the package does not guarantee full remediation due to possible additional malicious software installed during the compromise.

Immediate removal of the 'tn-advertisement' package version 5.0.0 is required. All secrets, credentials, and keys stored on the affected system must be rotated from a separate, secure machine. Due to the high likelihood of full system compromise, a thorough incident response and forensic analysis should be conducted to identify and remediate any additional malicious artifacts. There is no official patch or fix for this package; avoidance and removal are the primary mitigations.