The 'sm-checkout' npm package at versions 99.0.0 and 99.0.1 includes preinstall and postinstall scripts that invoke curl commands to a hardcoded bare-IP URL over plain HTTP (http://16.192.173.5/sm-checkout/pre and /post). This results in an unauthenticated outbound beacon on every install, leaking the source IP and install timing to the operator of the IP address. The package's versioning is deliberately inflated to win semver resolution against private packages of the same name, enabling it to be installed inadvertently in build systems and developer environments. The package is self-labeled as a dependency-confusion test but still performs malicious network activity. The OpenSSF Package Analysis project has flagged version 99.0.1 as malicious due to execution of commands associated with malicious behavior.

Installation of the affected 'sm-checkout' package versions causes the host to make unauthenticated outbound HTTP requests to a malicious server, leaking sensitive metadata such as source IP and install timing. This can compromise privacy and potentially aid attackers in reconnaissance or further attacks. The package's inflated version number increases the risk of accidental installation via dependency confusion. No direct code execution or payload delivery beyond the beaconing is described.

Avoid installing the 'sm-checkout' package versions 99.0.0 and 99.0.1. Remove these versions from any build or deployment pipelines. Use package integrity verification and strict dependency resolution to prevent dependency confusion attacks. Monitor package sources carefully and prefer official or trusted packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates or removals of the malicious package.