The 'dependency_confusions' npm package version 99.9.9 includes a postinstall lifecycle hook that runs index.js on npm install. This script gathers environment details such as os.userInfo(), os.hostname(), current working directory, local IPv4 address, and platform, then exfiltrates this information as JSON to a hardcoded webhook.site URL. This automatic data exfiltration matches known patterns of dependency confusion reconnaissance, enabling attackers to identify internal infrastructure and private package namespaces to target subsequent attacks against private registries.

The malicious postinstall script leaks sensitive environment information from the victim's build environment, including usernames, hostnames, directory paths, and network addresses. This information disclosure can aid attackers in crafting targeted dependency confusion attacks against private package registries, potentially leading to further compromise of internal systems or supply chain attacks.

No official patch or remediation is currently documented. Users should avoid installing the affected version (=99.9.9) of the 'dependency_confusions' package. Review and audit package dependencies for unexpected lifecycle scripts, especially postinstall hooks that perform network communications. Consider using package integrity verification and restricting installation of untrusted packages to prevent similar malicious code execution.