The 'editor_application' npm package at version 9999.0.0 includes a preinstall script that executes 'node callback.js'. This script gathers host-level data such as hostname, username, current directory, npm registry configuration, and private continuous integration repository slugs from environment variables associated with multiple CI providers (GitHub, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins). It then transmits this information via plain HTTP GET requests to a hardcoded attacker-controlled IP endpoint (http://75.119.137.232:31337/depconfuse). The version number and endpoint path serve as a signature for a dependency confusion beacon, which attackers use to map internal package namespaces and CI topologies of the organizations installing this package.

The malicious preinstall script leaks sensitive environment and CI metadata to an external attacker-controlled server. This exposure can reveal internal organizational structure, private repository identifiers, and CI environment details, potentially aiding further targeted attacks or supply chain compromises. There is no indication of direct code execution beyond data exfiltration, and no known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing the 'editor_application' package version 9999.0.0. Review and audit package dependencies for unexpected preinstall scripts, especially those that transmit data externally. Monitor for updates or advisories from the package maintainers or npm registry. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.