The npm package sc-payment-utils version 9999.0.0 contains a malicious preinstall script that executes callback.js during installation. This script collects sensitive host information including hostname, username, current directory, npm registry, and various CI environment variables. It then sends this data via an HTTP GET request to a hardcoded IP address, indicating reconnaissance activity consistent with dependency confusion attacks targeting internal package names leaked to public registries.