The @wbnr/frontend-shared npm package versions 99.0.0 and 99.0.1 include a preinstall.js script that executes automatically during npm install. This script reads environment variables for the OS username and uses the system hostname, embedding these values into a subdomain of a hardcoded callback domain (4otph6fase1x2won0hrfzul2wt2qqge5.oastify.com). It then transmits this data via DNS and HTTPS GET requests to the callback host under the /depconf/ path. This behavior is consistent with a dependency-confusion attack probe, leaking installer identifiers to a third-party infrastructure.

The malicious preinstall script leaks sensitive environment information such as the OS username and hostname to an external domain controlled by an attacker. This disclosure can aid attackers in reconnaissance and further targeted attacks. There is no indication of direct code execution or system compromise beyond information leakage. No known exploits in the wild have been reported.

No official patch or remediation has been provided for this package. Users should avoid installing versions 99.0.0 and 99.0.1 of @wbnr/frontend-shared. Consider auditing dependencies for malicious lifecycle scripts and use trusted package sources. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue.