The react-context-form-tdsss package at version 9.0.0 is a dependency-confusion attack payload published on npm. Its package.json includes a preinstall script that runs 'node index.js' during installation. The index.js script performs an HTTPS GET request to a hardcoded OAST (Out-of-band Application Security Testing) domain, which acts as a beacon to disclose the installer's public IP and confirm code execution. The package self-identifies as a proof-of-concept for dependency confusion and squats an internal/private package name to trick victim environments into installing it. This results in unauthorized outbound network communication from the installer's machine.

Installing [email protected] causes unauthorized code execution on the installer's machine and outbound network communication to a malicious domain. This leaks the installer's public IP address to the attacker and confirms that the malicious code ran successfully. The package exploits dependency confusion to be installed in victim environments, potentially leading to further compromise depending on the environment and usage.

No official patch or remediation is currently available for [email protected]. Users and organizations should avoid installing this package version. Review and audit dependencies to detect and remove this malicious package if present. Use strict package name resolution policies to prevent dependency confusion attacks. Monitor package sources carefully and prefer verified packages from trusted authors. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.