The sc-payment-utils package at version 9999.0.0 includes a preinstall script that runs callback.js when the package is installed via npm. This script gathers host identity details such as os.hostname(), os.userInfo().username, the current working directory, the configured npm registry, and multiple continuous integration repository slug environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH). It then issues an HTTP GET request to a fixed IP endpoint (http://75.119.137.232:31337/depconfuse) with these details as query parameters. The version number and the nature of the callback suggest this is a dependency confusion reconnaissance payload designed to collect information about internal package usage leaked into public package resolution.

The malicious script leaks sensitive environment and host information to an external attacker-controlled server. This reconnaissance data could be used to facilitate further attacks such as dependency confusion or supply chain compromise. There is no indication of direct code execution or data destruction beyond information disclosure. No known exploits in the wild have been reported.

No official patch or remediation is currently documented. Users should avoid installing sc-payment-utils version 9999.0.0. Since this is a malicious package version, the best mitigation is to remove or block this package from use. Monitor package sources and dependency trees for suspicious or unexpected versions. Patch status is not yet confirmed — check the vendor or npm advisories for updates.