The dust-helpers npm package at version 9999.0.0 includes a malicious preinstall script that runs 'node callback.js'. This script gathers system and environment information such as os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and various CI environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH). It then sends this data as query parameters in an HTTP GET request to the hardcoded endpoint http://75.119.137.232:31337/depconfuse. This behavior matches a dependency confusion reconnaissance pattern, where an attacker publishes a high-version package with an internal-sounding name to the public npm registry. Private builds that mistakenly resolve this package leak identifying information to the attacker, enabling targeted supply-chain intrusion.

Sensitive internal environment details, including hostnames, usernames, working directories, internal registry URLs, and CI repository identifiers, are exfiltrated to an attacker-controlled server during package installation. This leakage can facilitate targeted follow-on supply-chain attacks against the affected organization by revealing internal infrastructure and build environment details.

No official patch or remediation is indicated in the provided data. Users should avoid installing the dust-helpers package at version 9999.0.0. Audit package dependencies for suspicious versions and names, especially those with unusually high version numbers. Implement strict dependency resolution policies to prevent dependency confusion attacks. Monitor for and remove any installations of this malicious package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.