This threat involves malicious code embedded in the npm package @businessapp-microsites/apis at versions 9999.0.0 and 9999.0.1. The package squats on the @businessapp-microsites scope, which is unregistered, and publishes a version number (9999.0.0) designed to outrank any legitimate internal package during dependency resolution. The package.json includes a postinstall script that runs a Node.js command to perform an HTTPS GET request to a third-party domain with a unique token. This outbound callback confirms execution and leaks the installer's source IP and installation event. This is a canonical example of a dependency-confusion attack, where an attacker publishes a malicious package to a public registry to be inadvertently installed instead of a legitimate internal package.

The impact is the disclosure of the installer's source IP address and confirmation that the malicious package was installed on the machine. This can lead to privacy violations and potentially enable further targeted attacks. There is no indication from the data that the package performs additional malicious actions beyond this beaconing behavior.

No official patch or remediation is available as this is a malicious package published to the public npm registry. Users should avoid installing packages from untrusted or unregistered scopes, especially those with suspiciously high version numbers like 9999.0.0. Verify package provenance and use scoped registries or internal package registries to prevent dependency confusion attacks. Monitor dependency manifests for unexpected or unknown packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.