application_base@9999.0.0

Analysis

Dependency-confusion package (generic name, version 9999.0.0) with a preinstall hook that collects system and CI/CD environment data and exfiltrates it to a remote server. The hook reads the hostname, username, current working directory, npm registry URL, and a wide range of CI/CD environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), then sends them as HTTP GET query parameters to 75[.]119[.]137[.]232:31337/depconfuse. The exfiltration was confirmed at runtime.