The sc-geeksquad-core package at version 9999.0.0 declares a preinstall script that executes automatically during npm install. This script gathers the installer's hostname, OS username, current working directory, npm registry configuration, and various continuous integration repository environment variables. It then sends this data via an HTTP GET request to a hardcoded IP address (http://75.119.137.232:31337/depconfuse). The use of a placeholder version and a generic scoped package name indicates this package is designed to perform dependency confusion reconnaissance, aiming to identify private package builds that may be vulnerable to substitution by malicious public packages.

The malicious preinstall script can exfiltrate sensitive environment and system information from developers or build systems installing this package. This reconnaissance data can be used by attackers to identify and target vulnerable private package namespaces for further exploitation. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently documented. Users should avoid installing the sc-geeksquad-core package at version 9999.0.0. Organizations should audit their package dependencies for suspicious or placeholder-version packages and implement controls to prevent dependency confusion attacks, such as strict package name scoping and private registry enforcement. Monitor vendor advisories for updates regarding this package.