The 'sm-payment' npm package versions 99.0.0 and 99.0.1 include preinstall and postinstall lifecycle scripts that automatically perform HTTP requests to a hardcoded IP address (http://16.192.173.5/sm-payment/pre and /post) during installation. The package has no legitimate build or native-addon purpose that would justify such network activity. This unsolicited callback signals to an external operator that the package has been installed on a host, consistent with reconnaissance beacons used in dependency confusion or namesquatting attacks. The OpenSSF Package Analysis project identified this package as malicious due to execution of commands associated with malicious behavior.

The malicious preinstall and postinstall scripts cause the host installing the package to send network requests to an attacker-controlled IP address, potentially exposing information about the host environment and installation activity. This may facilitate further targeted attacks or reconnaissance by the adversary. No direct exploitation or payload delivery details are provided, and no known exploits in the wild have been reported.

No official patch or remediation is indicated. Users should avoid installing the 'sm-payment' package versions 99.0.0 and 99.0.1. Review and remove these package versions from projects and dependency trees. Use trusted package sources and verify package integrity before installation. Monitor for updates or advisories from the package maintainers or npm registry regarding this package.