The npm package 'appsignal' at version 9999.0.0 shadows the legitimate '@appsignal/*' namespace and employs a preinstall script that automatically runs during installation. This script performs an HTTP GET request to a hardcoded bare-IP endpoint (http://75.119.137.232:31337/depconfuse), transmitting information including the installer's hostname, username, current working directory, npm registry URL, and various CI repository environment variables. The use of a high version number (9999.0.0) and the bare-IP endpoint indicate this package is a dependency confusion reconnaissance probe designed to detect internal build systems that mistakenly resolve this public package instead of intended private packages.

The malicious package can exfiltrate sensitive environment and system information from build environments during installation. This reconnaissance can facilitate further attacks by identifying vulnerable internal build systems that resolve public packages over private ones, potentially leading to supply chain compromise.

No official patch or remediation is indicated. Users should avoid installing the 'appsignal' package at version 9999.0.0 and ensure their package resolution does not mistakenly prioritize public packages over intended private scoped packages. Review and restrict package sources and verify package authenticity before installation.