The 'sm-admin' npm package at versions 99.0.0 and 99.0.1 includes preinstall and postinstall lifecycle scripts that perform HTTP GET requests to a hardcoded bare IPv4 address (http://16.192.173.5/sm-admin/pre and /post). This behavior leaks the installer's source IP address and confirms the package name's resolution on the host. The elevated version number and callback pattern suggest this is a dependency-confusion probe targeting private registries. The endpoint is attacker-controlled and unauthenticated, allowing dynamic response manipulation. The OpenSSF Package Analysis project classifies this package as malicious due to executing commands linked to malicious activity.

Installing the affected versions of 'sm-admin' causes the host to make unencrypted network requests to an attacker-controlled endpoint, potentially exposing the installer's source IP and internal package name resolution. The attacker can change the response content at any time, which could lead to further malicious actions during installation. No known exploits in the wild have been reported.

Avoid installing the 'sm-admin' package versions 99.0.0 and 99.0.1. Since no official patch or remediation is indicated, users should remove these versions from their dependency trees and verify that no transitive dependencies include this package. Monitor package sources carefully to prevent dependency confusion attacks. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.