speaker_tagging_media_player@9999.0.0

Analysis

Dependency-confusion package with a preinstall hook that collects system and CI/CD environment metadata and exfiltrates it to a remote server. On install, callback.js runs and sends the hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GitHub, GitLab, Bitbucket, Travis, Drone, Buildkite, CircleCI, Jenkins) via HTTP GET to 75[.]119[.]137[.]232:31337/depconfuse. The package name and version 9999.0.0 follow the dependency-confusion attack pattern to trick automated dependency resolvers into installing it.