The yandex-geobase npm package in specified versions includes a postinstall script that contacts an external bare IP address (http://130.49.177.51:18080/p/dc-20260627-yandex-geobase) on every install. This request transmits the package name, version, and a campaign identifier, confirming code execution inside the installer's environment to an external third party. Although the package self-identifies as a proof-of-concept for dependency confusion testing, the external beaconing behavior can leak sensitive build environment information to an untrusted host. This behavior is consistent with dependency confusion canary infrastructure rather than legitimate package functionality.

The impact is information leakage from the build environment to an external third party. This could allow an attacker to confirm that their malicious package was installed and executed within a target's build pipeline. There is no evidence of direct code execution beyond the postinstall beaconing, and no known exploits in the wild have been reported. However, the exposure of build environment details may facilitate further targeted attacks.

No official patch or remediation is currently documented. Users should avoid installing the affected versions of yandex-geobase from public npm registries, especially in internal build environments expecting a legitimate internal package. Consider using scoped or private registries to prevent dependency confusion attacks. Monitor for updates or advisories from the package maintainers or npm registry regarding remediation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.