The react-wp-viewer package in specified versions is a dependency-confusion malicious package. Its postinstall script performs an HTTP GET request to a hardcoded IP address, transmitting the package name, version, and a fixed nonce. This request leaks the installer's source IP and network environment information to an attacker-controlled server over unencrypted HTTP. The package self-identifies as a dependency-confusion proof-of-concept, indicating it is squatting on a package name to capture internal environment data when resolved in place of a private package. No credential theft occurs, but the reconnaissance data gathered can aid attackers in further exploitation.

The impact is limited to information disclosure of the installer's network environment, including source IP and hostname-derived network position. This reconnaissance data can assist attackers in mapping internal environments and confirming the presence of internal packages with the same name. No direct credential theft or code execution beyond the postinstall hook is reported.

No official patch or fix is currently documented. Users should avoid installing the affected versions (=0.2.4, =0.2.15, =0.2.99) of react-wp-viewer from the public npm registry. Verify package provenance before installation and consider using scoped or private package namespaces to prevent dependency confusion. Monitor for updates or advisories from the package maintainers or npm regarding remediation.