The malicious sc-font-icons package (version 9999.0.0) includes a preinstall script that executes automatically on npm install. The script collects installer-side identifiers including os.hostname(), os.userInfo().username, process.cwd(), the configured npm registry, and CI repository slugs from environment variables like GITHUB_REPOSITORY and CI_PROJECT_PATH. It sends this information over plain HTTP GET requests to a hardcoded IP address (http://75.119.137.232:31337/depconfuse), which is not part of any legitimate npm registry or infrastructure. The version number and beacon path indicate this package is used as a dependency confusion probe to identify internal package names and environments that mistakenly resolve private packages to the public registry. This results in leakage of internal repository and infrastructure naming information to an unauthorized third party.

The impact is information disclosure of internal environment details including hostnames, usernames, working directories, private registry URLs, and repository slugs. This can aid attackers in reconnaissance and further targeted attacks. No direct code execution or system compromise is described, but the leak of sensitive internal metadata poses a significant privacy and security risk.

No official patch or remediation is currently documented. Users should avoid installing the sc-font-icons package version 9999.0.0. Review and audit dependencies for suspicious or unexpected packages, especially those with unusual version numbers or preinstall scripts. Consider implementing strict dependency resolution policies to prevent dependency confusion attacks. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.