The wolverinechat package.json declares a preinstall hook that runs index.js during npm install. This script reads sensitive files and system information such as /etc/passwd, /etc/hosts, os.hostname(), os.userInfo().username, the user's home directory, dns.getServers(), and package metadata. It then sends this collected data via HTTPS POST to a hardcoded subdomain (7ckdbwo9f8dtrg8y36sbe4e8lzrqfg35.oastify.com), which is a Burp Collaborator OAST callback domain. The exfiltration occurs automatically at install time without any user interaction, indicating malicious intent embedded in the package.

Sensitive system and user information can be exfiltrated to an attacker-controlled server during package installation. This compromises confidentiality of system files and user environment details, potentially enabling further attacks or privacy violations. The automatic execution at install time increases risk as users may be unaware of the data leakage.

No official patch or remediation is currently documented. Users should avoid installing version 1.0.1 of wolverinechat. Verify package integrity before installation and consider using trusted package sources or scanning tools to detect malicious scripts. Monitor vendor advisories for updates or fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.