The 'whs4_deu' npm package versions 1.0.0 and 1.0.1 include a postinstall hook that executes 'index.js' upon installation. This script collects sensitive environment information such as the absolute filename path (which can reveal OS username and directory structure), Node.js version, and system architecture, then sends this data to a hardcoded Discord webhook URL. The webhook URL is split in the code to avoid simple detection by string searches. The package does not offer any functionality consistent with its name, and its sole observable behavior is this install-time data beaconing. The OpenSSF Package Analysis project and Amazon Inspector have identified this package as malicious due to its unauthorized data exfiltration and communication with a suspicious domain.

The malicious postinstall script can leak sensitive environment information including the installer's file path, potentially exposing usernames and directory layouts, as well as Node.js version and platform details. This data exfiltration to a hardcoded external webhook can aid attackers in reconnaissance or further targeted attacks. There is no indication of direct code execution beyond the postinstall script or broader system compromise from the provided data.

Users should avoid installing the 'whs4_deu' package versions 1.0.0 and 1.0.1. Since no official patch or remediation is indicated, the best mitigation is to remove or block usage of this package. Monitor package sources and dependency trees to prevent inadvertent installation. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.