The yandex-geobase npm package in specified versions includes a postinstall script that contacts an external bare-IP endpoint (http://130.49.177.51:18080/p/dc-20260627-yandex-geobase) on every install. This request sends the package name, version, and a campaign identifier, confirming code execution within the installer's environment. The package self-identifies as a proof-of-concept for dependency confusion but nonetheless leaks build environment information to a third party. This behavior is indicative of malicious intent or at least unauthorized data exfiltration via a dependency confusion canary mechanism. No official patch or remediation guidance is provided.

The malicious postinstall script leaks information about the package and its environment to an external attacker-controlled server. This can confirm successful code execution inside the build environment, potentially exposing sensitive build pipeline details. While no direct code execution beyond the postinstall script is described, the information leak could aid attackers in further targeting or reconnaissance. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, avoid using the affected versions of the yandex-geobase package from public npm sources, especially in internal build environments where dependency confusion is a risk. Consider using scoped or internal package registries to prevent dependency confusion attacks. Monitor for updates or advisories from the package maintainers or npm security teams.