editor_application@9999.0.0

Analysis

A dependency-confusion package (version 9999.0.0, generic name "editor_application") that exfiltrates system metadata on install. The preinstall hook in callback.js collects the hostname, username, current working directory, npm registry URL, and CI/CD environment variables from up to 9 providers (GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines, Travis CI, Drone CI, Buildkite, CircleCI, Jenkins). This data is sent via HTTP GET to 75[.]119[.]137[.]232:31337 at the path /depconfuse. The package has no repository, no meaningful code beyond the exfiltration payload, and its version number (9999.0.0) is characteristic of dependency-confusion attacks targeting internal package names.