The npm package pp-react-worldready-v5 version 1.0.0 is malicious. Its tarball contains only package.json and vishu.js, with the declared main file index.js missing, so it provides no library functionality. The package.json preinstall script runs vishu.js automatically on npm install. This script collects the installer's public IP address via api.ipify.org, the local hostname, and GitHub Actions environment variables (CI, GITHUB_ACTIONS, GITHUB_WORKFLOW, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_RUN_ATTEMPT). It sends this information as query parameters in an HTTPS GET request to a webhook.site URL controlled by the attacker and performs a DNS lookup to a Burp Collaborator (OAST) domain encoding the hostname for out-of-band data exfiltration. The package name resembles a typosquatting pattern consistent with dependency-confusion reconnaissance attacks.

Installation of this package results in unintended information disclosure, including the installer's public IP address, hostname, and CI environment variables related to GitHub Actions workflows. This data leakage can aid attackers in reconnaissance and potentially facilitate further targeted attacks. The package does not provide any legitimate functionality and is designed solely to exfiltrate data.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The best mitigation is to avoid installing this package and audit dependencies carefully to prevent typosquatting or dependency confusion attacks. Use trusted package sources and verify package integrity before installation.