The 'yastatic-s3' npm package (version 0.1.0) includes a postinstall lifecycle script that issues an HTTP GET request to a hardcoded IP address (130.49.177.51:18080) over plain HTTP. This request transmits the package name, version, and a nonce in the query string, confirming code execution on the installer's machine and unauthorized communication with an attacker-controlled endpoint. The package name and beacon path mimic Yandex's internal 'yastatic' static-asset and geobase namespace, consistent with a dependency confusion attack targeting Yandex build environments that mistakenly resolve this private package name from the public npm registry. This results in concrete harm by leaking internal build identifiers and demonstrating attacker code execution during installation.

Installation of the affected 'yastatic-s3' package version 0.1.0 leads to execution of attacker-controlled code on the host machine. It causes unauthorized network communication to an external IP, leaking internal build pipeline identifiers and confirming compromise. This undermines build integrity and confidentiality by exposing sensitive internal information and allowing remote attacker influence during package installation.

No official patch or remediation is currently documented. Users should avoid installing version 0.1.0 of the 'yastatic-s3' package. Verify package sources carefully to prevent dependency confusion attacks, especially in environments that resolve private package names from public registries. Monitor and restrict network egress from build environments to prevent unauthorized external communications during package installation. Check vendor advisories or trusted sources for updates or fixes.