The npm package [email protected] executes a script during its preinstall lifecycle hook that collects sensitive environment details such as os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry, and various CI repository environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH). It sends these details in an HTTP GET request to a non-first-party IP address (http://75.119.137.232:31337/depconfuse). This behavior serves as a reconnaissance beacon for dependency confusion attacks, signaling to attackers whether an internal package name resolves to their public registry entry within a target's build environment, thereby facilitating targeted internal-package hijacking.

The malicious code leaks sensitive environment and build information to an attacker-controlled server. This information can be used to confirm successful dependency confusion attacks and to tailor follow-on attacks targeting internal packages within the victim's build environment. While no direct exploitation or code execution beyond data exfiltration is described, the reconnaissance facilitates potentially serious supply chain attacks.

No official patch or remediation is currently documented for [email protected]. Users should avoid installing this specific version due to its malicious behavior. Monitor package sources carefully and prefer verified, trusted packages. Check vendor advisories or npm security notices for updates or removal of this malicious package. Since this is a malicious package published to a public registry, removing or blocking this version from internal use is recommended.