This threat involves a malicious npm package named 'voyager-web' at version 999.0.0, which is a typosquat of a legitimate open-source package. It declares preinstall and postinstall lifecycle hooks that run a script (callback.js) during 'npm install'. This script collects detailed system and CI environment metadata, including hostnames, user IDs, IP addresses, and environment tokens such as GITHUB_TOKEN and AWS_ACCESS_KEY_ID. The collected data is exfiltrated via HTTP POST to a hardcoded Discord webhook and also via DNS-based fallback. The package is described as a security research proof-of-concept but effectively compromises any system that installs it by leaking sensitive information to an attacker-controlled endpoint. The malicious package version 999.0.0 is specifically identified as the affected version.

Any system that installs this malicious package is subject to automatic exfiltration of sensitive host identifiers and CI environment credentials to an attacker-controlled Discord webhook. This results in a full compromise of secrets and keys stored on the system. The presence of this package indicates a high risk of credential theft and potential further compromise. Even after removal, the system may remain compromised due to possible additional malicious software installed by the attacker.

No official patch or fix is available for this malicious package as it is not a vulnerability in legitimate software but a malicious package itself. The affected package version is 999.0.0 of 'voyager-web'. Immediate removal of the package is recommended. All secrets and keys on the affected system should be considered compromised and must be rotated from a different, trusted machine. Due to the risk of full system compromise, a thorough incident response including system reimaging or forensic analysis is advised. Avoid installing packages from untrusted sources and verify package authenticity before installation.