The @espn-ping/react-dmed-oauth package at version 666.0.0 includes a preinstall lifecycle script that executes automatically on npm install. The script runs a Node.js process that gathers sensitive environment information including the installer's hostname, working directory, username, and public IP address (retrieved via an external curl request). This data is encoded and transmitted silently via a curl GET request to a suspicious external URL (https://r.dontvisitmy.website/sendreq.php). The output is suppressed to avoid detection in the installer's console. This package appears to be a malicious dependency confusion beacon targeting the ESPN/Disney internal namespace.

Installation of this package version results in unauthorized exfiltration of environment information to an external attacker-controlled server. This leakage of system and network details could facilitate further targeted attacks or reconnaissance. No direct code execution beyond the preinstall script is described, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing @espn-ping/react-dmed-oauth version 666.0.0. Review and restrict use of packages from untrusted or internal namespaces to prevent dependency confusion attacks. Monitor for updates or advisories from the package maintainers or npm registry for remediation.