The 'sm-billing-form' npm package at versions 99.0.0 and 99.0.1 includes preinstall and postinstall lifecycle scripts that automatically run curl commands to a hardcoded IP address (http://16.192.173.5/sm-billing-form/pre and /post) during npm install. This network activity leaks the source IP and installation timing to the attacker, enabling targeted follow-on attacks. The package versioning suggests it is a dependency confusion lure intended to supersede an internal package of the same name. The OpenSSF Package Analysis project has flagged this package as malicious due to execution of commands associated with malicious behavior.

Systems that install the affected versions of 'sm-billing-form' will execute unauthorized network requests to an attacker-controlled server, disclosing sensitive environment information such as source IP and installation timing. This information leakage can facilitate targeted attacks against those systems. The malicious code runs automatically during package installation without user consent.

Avoid installing the 'sm-billing-form' package versions 99.0.0 and 99.0.1. Remove any instances of these versions from your environment. Since no official patch or fix is available, do not use this package. Consider auditing your dependency sources to prevent dependency confusion and typosquatting attacks. Monitor for any unexpected network traffic to suspicious IP addresses during package installations.