The 'ap3-components-ui' npm package at version 9.999.0 includes a preinstall script that gathers installer-side environment information such as hostname, current working directory, username, and the installer's public IP address (retrieved via curl to ifconfig.me). This information is hex-encoded and sent as DNS subdomain queries to a domain controlled by the attacker (d987f5ra3q1r1j7ahol0yzuwujwe76i55.oast.fun) using an Interactsh collector. The package name is embedded in the exfiltrated data to correlate the source of the request. The package is a dependency-confusion attack artifact, published at a very high version (9.999.0) to supersede legitimate internal versions, and contains no legitimate library code or documentation.

Installation of this malicious package results in leakage of sensitive environment information from the installer system, including hostname, directory path, username, and public IP address. This data exposure could aid attackers in reconnaissance and further targeted attacks. There is no indication of code execution beyond the preinstall hook or other payloads. No known exploits in the wild have been reported.

No official patch or remediation is currently available. Users should avoid installing the 'ap3-components-ui' package at version 9.999.0. Verify internal package names and versions to prevent dependency confusion attacks. Implement strict package source controls and use package allowlists or internal registries to block untrusted or unexpected packages. Monitor for unexpected preinstall scripts in dependencies. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.