The dpdgroup-css npm package version 2.0.1 declares preinstall and postinstall lifecycle hooks that execute a setup.js script on every npm install. This script reads the local machine's hostname using os.hostname() and sends it via an HTTP GET request to a hardcoded external IP address (http://89.116.25.133:4444/dpdgroup-css/<hostname>) with the hostname also included in an X-PoC-Host header. The package name suggests it is impersonating an internal DPDgroup package, consistent with a dependency confusion attack. No legitimate library functionality is present, indicating the package is malicious and designed to leak internal host identifiers to an external attacker-controlled endpoint.

The malicious package leaks the hostname of the machine installing it to an external attacker-controlled server. This disclosure of internal build-host identifiers can aid attackers in reconnaissance and further targeted attacks. The package does not provide any legitimate functionality and runs code automatically during installation, which can lead to unintended data exposure.

No official patch or remediation is currently documented. Users should avoid installing dpdgroup-css version 2.0.1 from public npm registries. Verify internal package scopes and ensure dependency resolution does not pull public packages that impersonate internal ones. Monitor and audit package dependencies to prevent dependency confusion attacks. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.