The syft-acp-util npm package is a malicious package published as part of a dependency confusion reconnaissance campaign. It mimics an internal package name to trick misconfigured resolvers into installing it instead of the intended private package. The package includes a preinstall script that executes automatically during npm install, which collects the installer's public IP and other default PII and sends this telemetry to an attacker-controlled Sentry project. This behavior allows the attacker to identify successful installs and attribute them to specific victim organizations. The malicious payload is identical to a previous campaign named 'click2ai' and uses the same attacker infrastructure.