The npm package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 contains malicious code in its preinstall and postinstall hooks that run beacon.js. This script gathers system identifiers including os.hostname(), os.userInfo().username, and process.cwd(), encodes them as DNS labels, and sends DNS lookup requests to a subdomain of oastify.com, an attacker-controlled out-of-band service. This behavior enables automatic exfiltration of environment details to a third party during package installation, consistent with dependency confusion attack patterns where an attacker publishes a package mimicking an internal package to a public registry.

Installation of this package results in automatic leakage of sensitive environment information (host name, user name, and working directory) to an attacker-controlled domain. This can aid attackers in reconnaissance and further targeted attacks. There is no indication of code execution beyond the install scripts or other payloads, but the data exfiltration occurs without user consent or invocation.

No official patch or remediation is currently documented. Users should avoid installing the package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 from public npm registries. Verify package sources and scopes to prevent dependency confusion attacks. Monitor for and remove any installations of this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.