The eslint-angular-react npm package version 110.0.1 declares a preinstall lifecycle script that automatically runs on npm install without user interaction. This script performs an HTTP request to a hardcoded IP address (http://109.71.252.153:8080/) sending the installer's OS, username, working directory, and hostname as query parameters. The package contains only a README and package.json, with no actual code implementing ESLint functionality, indicating its sole purpose is to collect reconnaissance data. The package name mimics the ESLint plugin namespace, consistent with a typosquatting or dependency confusion attack vector aimed at developers.

The malicious preinstall script leaks sensitive environment information from the installer's system to an external server. Although no direct code execution beyond the preinstall script is described, this reconnaissance data could facilitate further targeted attacks or information gathering. The package does not provide any legitimate functionality and could mislead developers into installing it under false pretenses.

No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing eslint-angular-react version 110.0.1 and to verify package authenticity before installation. Use trusted package sources and consider using package integrity verification tools. Monitor for and remove any installations of this package from development environments.