The 'store-locator-widget' npm package at version 9999.0.0 exports an empty module and includes a preinstall hook that executes 'node callback.js' during installation. This script collects the installer's hostname, username, current working directory, npm registry configuration, and CI environment variables (such as GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME). It then transmits this data via HTTP GET parameters to a hardcoded IP address (http://75.119.137.232:31337/depconfuse). The package's version number, empty functionality, and the '/depconfuse' endpoint indicate it is designed for dependency confusion reconnaissance, leaking internal package namespace and build environment information to an attacker.

Installation of this package results in leakage of sensitive environment and build metadata to an attacker-controlled server. This can expose internal repository names, usernames, hostnames, and CI project identifiers, potentially aiding further targeted attacks or reconnaissance. The package itself does not provide functionality but acts as a reconnaissance tool during the npm install process.

No official patch or fix is available for this malicious package. The best mitigation is to avoid installing the 'store-locator-widget' package version 9999.0.0 from untrusted or public npm registries. Organizations should audit their dependency sources and implement controls to prevent dependency confusion attacks, such as using scoped packages, private registries, and verifying package provenance before installation.