The 'sm-apikey-model' npm package versions 99.0.0 and 99.0.1 include lifecycle scripts that invoke curl commands to a hardcoded bare-IP HTTP endpoint during installation. These scripts send callbacks confirming each host that installed the package along with the installer's source IP address. The package's versioning and beacon behavior align with reconnaissance tactics used in malicious namespace-squatting packages, designed to identify and track systems installing the package rather than provide functional code. The OpenSSF Package Analysis project flagged this package as malicious due to execution of commands associated with malicious behavior.

Installation of the affected package versions results in disclosure of the installer's source IP address and confirmation of package installation to an external malicious operator. This can facilitate reconnaissance and tracking of systems that install the package. No direct code execution or payload delivery beyond the reconnaissance beacon is described.

Avoid installing the 'sm-apikey-model' package versions 99.0.0 and 99.0.1. Remove any existing installations of these versions. Since no official fix or patch is indicated, rely on blocking or filtering network traffic to the hardcoded IP address and monitoring for suspicious package installations. Check vendor or repository advisories for updates or removal of the malicious package.