The sm-oauth package version 99.0.0 declares preinstall and postinstall scripts in its package.json that execute curl commands to a hardcoded IP address (http://16.192.173.5/sm-oauth/pre and /post) on every npm install. These requests leak the installer's source IP, install event, and request metadata to the attacker-controlled endpoint. The package's index.js exports no functional code and serves only to facilitate this outbound callback, enabling the operator to deliver follow-on content via HTTP responses. This behavior constitutes malicious code embedded in the npm package.

Installation of sm-oauth version 99.0.0 results in leakage of the installer's network identity and metadata to an attacker-controlled server. This can expose sensitive information about the environment where the package is installed. Additionally, the attacker can serve arbitrary follow-on content during installation, potentially leading to further compromise or malicious payload delivery.

No official patch or remediation is currently documented. Users should avoid installing sm-oauth version 99.0.0. Since the package performs malicious network callbacks during installation, removing or blocking access to the hardcoded IP address can mitigate data leakage. Monitor package sources carefully to avoid dependency confusion or malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.