The [email protected] npm package is an empty module whose package.json preinstall hook executes a script that gathers installer-side information including hostname, username, current working directory, npm registry configuration, and continuous integration repository environment variables. This data is transmitted via plain HTTP GET requests to a remote IP address (http://75.119.137.232:31337/depconfuse) with the goal of identifying environments where an internal package name resolves, enabling follow-up targeted dependency confusion attacks. The package version 9999.0.0 is deliberately chosen to outrank internal packages during npm resolution. There is no functional code beyond this reconnaissance behavior.

The package leaks sensitive environment and system information to an external attacker-controlled server during installation. This information disclosure can aid attackers in identifying targets for dependency confusion attacks within internal networks. There is no direct code execution or payload beyond data exfiltration, and no known exploits in the wild have been reported.

No official patch or fix is available for this malicious package version. Users should avoid installing the rebrandly-domains-search-client package version 9999.0.0 from untrusted sources. Implement strict package source verification and use scoped or private registries to prevent dependency confusion. Monitor package dependencies for unexpected or suspicious versions. Since this is a malicious package published to npm, removing or blocking this version from internal registries and build pipelines is recommended.