The jquery.ui.tabs package version 9999.0.0 is a dependency confusion squat published on npm. It contains an empty main module but includes a preinstall lifecycle script that executes node callback.js. This script gathers system information including os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and environment variables related to various CI services (GitHub, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins). The collected data is sent via plain HTTP as query parameters to a hardcoded IP address (http://75.119.137.232:31337/depconfuse). The intent is to identify organizations that mistakenly resolve this public package name internally, leaking sensitive internal environment information to an attacker-controlled server.

If a developer or build system installs [email protected], the preinstall script will exfiltrate sensitive environment information including internal hostnames, usernames, current working directories, npm registry configuration, and CI repository identifiers. This information disclosure could aid attackers in reconnaissance and further targeted attacks. There is no indication of code execution beyond the preinstall script or direct system compromise from this package alone.

Avoid installing or using the jquery.ui.tabs package version 9999.0.0 from the public npm registry. Verify internal package resolution configurations to prevent dependency confusion attacks. Since no official patch or fix is available for this malicious package, organizations should audit their dependency sources and lock down package resolution to trusted registries or internal scopes. Monitor for unexpected package versions and preinstall scripts in your supply chain.