Malicious code in karma-proxy (npm)

The npm package karma-proxy was found to contain malicious code embedded in its postinstall lifecycle script. Upon installation, the script collected sensitive host identifiers including hostname, platform, architecture, Node.js version, package name, and lifecycle event information.\n\nThis data was automatically POSTed as JSON to a hardcoded attacker-controlled endpoint at https://e14giapf.instances.poc.jchunt.top/karma-proxy. The exfiltration occurred unconditionally on every install with no user opt-in, configuration option, or disclosure in the package's advertised purpose.\n\nThe destination domain is an author-controlled subdomain unrelated to npm registry or vendor infrastructure, indicating direct attacker control. The malicious behavior was identified and reported by the OpenSSF malicious-packages project.\n\nAll users who installed karma-proxy during the compromise period were affected and had their host identifiers collected by the attacker.