The 'rebrandly-domains-digger' npm package version 9999.0.0 declares a preinstall hook that executes 'node callback.js' during installation. This script gathers installer-side information including hostname, username, current working directory, npm registry configuration, and CI environment variables such as GITHUB_REPOSITORY. It then sends these details as query parameters in an HTTP GET request to a hardcoded IPv4 address (75.119.137.232) on port 31337, using the path '/depconfuse'. This pattern matches reconnaissance activity for dependency confusion attacks, aiming to identify organizations that use an internal package named 'rebrandly-domains-digger' to later target them with malicious packages. The destination is unrelated to any legitimate publisher infrastructure and uses unencrypted HTTP.

The malicious preinstall script leaks sensitive environment and system information to an attacker-controlled server. This information can be used to identify organizations that have internal packages named 'rebrandly-domains-digger', enabling targeted dependency confusion attacks. While no direct exploitation or payload delivery is described, the reconnaissance facilitates subsequent supply chain attacks.

Users should avoid installing version 9999.0.0 of 'rebrandly-domains-digger'. Since no patch or fix is indicated, the best mitigation is to not use this package version. Review dependency trees for this package and remove or replace it if found. Monitor for any updates or advisories from trusted sources regarding this package. There is no vendor advisory or official fix currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.