crud-respect@999.99.99

Analysis

Dependency confusion attack published as crud-respect@999.99.99 with a synthetically high version to be installed ahead of a legitimate internal package. On npm install (both preinstall and postinstall hooks), the package runs callback.js which collects system information (hostname, platform, architecture, local and external IP addresses, operating system release, username, home directory, current working directory, CI environment indicators, Node.js version) and ALL process environment variables (including NPM_TOKEN, GITHUB_TOKEN, and any other secrets in the environment), then POSTs this data as a JSON payload to hxxp://132[.]243[.]20[.]244:8000/api/collect.