The @debile/require-dir npm package republishes the code of the legitimate require-dir package under a different scope, effectively a typosquat. Its package.json preinstall script contains a bash command that conditionally executes a curl request to an attacker-controlled Interactsh (oast.fun) domain. The condition is currently always false ([[ 1 == 2 ]]), preventing actual network requests during installation. However, if the condition is altered to true, the package would send an install-time out-of-band beacon to the attacker, enabling reconnaissance or dependency confusion attacks. This behavior is present in versions 1.9.1 and 1.9.2 of the package.

If the conditional guard in the preinstall script is modified or bypassed, the package could send network requests to an attacker-controlled server during installation. This could be used for reconnaissance or to confirm installation in victim environments. Currently, the curl command is disabled by an always-false condition, so no active network communication occurs. There are no reports of exploitation in the wild.

No official patch or fix is currently available. Users should avoid installing the @debile/require-dir package, especially versions 1.9.1 and 1.9.2. Verify dependencies carefully to avoid typosquatted or malicious packages. Monitor for updates from the package maintainer or npm advisories for remediation. Since the malicious code is gated behind a false condition, no immediate active exploitation occurs unless the code is modified.