The yandex-geobase npm package in specified versions includes a postinstall script that performs an HTTP GET request to a hardcoded external bare IP address (http://130.49.177.51:18080/p/dc-20260627-yandex-geobase) on every installation. This beacon transmits the package name, version, and a campaign identifier, confirming code execution in the installer's environment to a third party. Although labeled as a 'Dependency confusion security test placeholder' and 'PoC', this behavior effectively signals that attacker-controlled code ran inside the build environment. The use of a bare IP on a non-standard port, unrelated to any official registry or telemetry endpoint, indicates malicious intent consistent with dependency confusion attack infrastructure. The package compromises any system it is installed on, potentially granting full control to an external entity.

Any system with the affected yandex-geobase package installed or running should be considered fully compromised. The package's postinstall script allows external actors to confirm code execution within the build or host environment, potentially enabling further malicious actions. All secrets and keys stored on the compromised system are at risk and should be rotated immediately from a secure, unaffected system. Removing the package alone may not eliminate all malicious software or backdoors introduced during installation.

Remove the yandex-geobase package immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised systems using a secure, unaffected environment. Due to the potential full compromise of the host, additional forensic analysis and remediation may be necessary. There is no official patch or fix available; therefore, avoid using this package and monitor for any signs of persistent compromise.