The 'ttspc-server-sample' npm package at specified versions declares a postinstall script that runs 'index.js' automatically during installation. This script collects extensive host information such as hostname, username, current directory, network IPs and MAC addresses, OS details, environment variables including those resembling credentials, and a full process list. It then sends this data via HTTP POST to a hardcoded attacker-controlled Burp Collaborator endpoint. The package uses a high version number (99.9.x) to supersede legitimate private packages in victim organizations, constituting a dependency confusion supply-chain attack. The package is identified as malicious by multiple sources including Amazon Inspector, GHSA malware database, and OpenSSF Package Analysis. There is no CVSS score or known exploits in the wild reported. The attack compromises the host fully, requiring secret rotation and comprehensive remediation.

Installation of this package results in immediate exfiltration of sensitive host information and environment variables that may contain credentials. The attacker gains knowledge of internal IP addresses, running processes, and potentially secret keys. The system is considered fully compromised, and secrets stored on the host should be rotated. Removal of the package does not guarantee full remediation due to possible further malicious persistence.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove the package from any affected systems and consider those systems fully compromised. All secrets and keys stored on the compromised hosts should be rotated from a secure, unaffected environment. Vigilance against dependency confusion attacks is advised, including strict controls on package source resolution and verification of package provenance.