The vscode-designer-14 npm package version 14.0.1 declares a preinstall hook in its package.json that executes index.js upon installation. The index.js script collects detailed system information such as the installer's hostname, username, home directory, DNS server configuration, package metadata, and the contents of sensitive files /etc/passwd and /etc/hosts. It then sends this information over HTTPS to a hardcoded external domain (slh4v8u1tz6gjo447tgf9rl3xu3mrcf1.oastify.com), which is identified as a Burp Collaborator OAST subdomain used for out-of-band interaction testing. The package lacks any legitimate functionality that would require such data collection or external communication, indicating malicious intent consistent with a dependency confusion or typosquatting exfiltration beacon.

Installation of this malicious package results in unauthorized disclosure of sensitive system information to an external attacker-controlled server. This includes user and system identifiers and contents of critical system files, potentially enabling further targeted attacks or system compromise. There is no indication of direct code execution beyond data exfiltration, and no known active exploits in the wild have been reported.

No official patch or remediation is currently documented for this package. Users should avoid installing vscode-designer-14 version 14.0.1 and remove it if already installed. Verify package authenticity before installation, especially for similarly named packages, to prevent typosquatting or dependency confusion attacks. Monitor package sources and use trusted registries. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.