The jquery.ui.core package version 9999.0.0 on npm is a dependency-confusion squat designed to perform reconnaissance on internal build environments. Its main module exports an empty object, but a preinstall script executes automatically during npm install. This script gathers system details such as os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry, and multiple continuous integration environment variables related to repository identification. It then sends this data via an HTTP GET request to a hardcoded IP address (http://75.119.137.232:31337/depconfuse). The package's characteristics—an unusually high version number, empty module body, plaintext HTTP communication, and collection of CI environment variables—match known dependency-confusion reconnaissance tactics aimed at detecting misconfigured private package resolutions.

The malicious package can exfiltrate sensitive environment and build system information to an external server during installation. This reconnaissance can reveal internal hostnames, usernames, working directories, npm registry configurations, and CI repository identifiers, potentially aiding attackers in further targeted attacks or supply chain compromises. There is no indication of direct code execution beyond the preinstall script or active exploitation in the wild at this time.

Users should avoid installing the jquery.ui.core package version 9999.0.0 from the public npm registry, as it is a known malicious dependency-confusion package. Verify that private package names are correctly scoped and resolved to private registries to prevent accidental resolution to public malicious packages. Monitor package dependencies for unexpected or unusually high version numbers. Since no official patch or fix is available, the primary mitigation is to remove or avoid this malicious package and ensure proper package resolution configurations.