The 'pp-react-v5' npm package is a malicious package designed for dependency confusion attacks by impersonating an internal package with the same name at inflated versions 10.0.0, 30.0.1, and 30.0.2. Upon installation, its preinstall and postinstall scripts execute code that gathers host identifiers including os.hostname(), os.userInfo().username, os.homedir(), process.cwd(), DNS servers, and local package.json contents. This information is exfiltrated via HTTPS POST requests to a hardcoded out-of-band collector domain controlled by the attacker. The package contains no legitimate source code and serves solely to collect and leak environment metadata without authentication.

Installing this malicious package results in unauthenticated disclosure of sensitive environment information such as the installer's username, hostname, working directory, and local package metadata to attacker-controlled servers. This can lead to reconnaissance that may facilitate further targeted attacks or compromise of internal systems relying on the same package name. No direct code execution beyond data exfiltration is described.

Avoid installing the 'pp-react-v5' package at versions 10.0.0, 30.0.1, and 30.0.2 from public npm registries. Verify internal package names and use scoped packages or private registries to prevent dependency confusion attacks. Since no official patch or fix is available, do not rely on these versions. Audit your dependency trees for unexpected or suspicious packages named 'pp-react-v5' and remove any occurrences. Consider implementing strict package resolution policies to avoid untrusted packages overriding internal dependencies.