The widget-forge npm package at version 9999.0.0 is designed as a dependency-confusion beacon. Its package.json declares a preinstall script ('node callback.js') that executes automatically during installation. This script collects data including the OS hostname, username, current working directory, npm registry configuration, and continuous integration repository environment variables (e.g., GITHUB_REPOSITORY). It then sends this information via an HTTP GET request to a hardcoded IP address (http://75.119.137.232:31337/depconfuse). The package exports an empty object and has no functional code beyond this reconnaissance behavior. The version number 9999.0.0 is used to supersede legitimate internal package versions, a common tactic in dependency confusion attacks.

Installation of this package results in the disclosure of system and environment information to an external attacker-controlled server. There is no direct code execution or functional payload beyond this data exfiltration. No known exploits in the wild have been reported. The impact is primarily information leakage that could aid further attacks.

Avoid installing the widget-forge package at version 9999.0.0 or any suspicious packages with unusually high version numbers that may be part of dependency confusion attacks. Review and restrict npm package sources and registries to trusted repositories. Since no official patch or fix exists for this malicious package, prevention by avoiding installation is the primary mitigation.