dust-helpers@9999.0.0

Analysis

A dependency-confusion package impersonating the legitimate dust-helpers library. The preinstall hook (node callback.js) collects the installer's hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, TRAVIS_REPO_SLUG, CIRCLE_PROJECT_REPONAME, and others), then beacons this metadata via HTTP GET to 75[.]119[.]137[.]232:31337/depconfuse. This is reconnaissance for supply-chain targeting — the attacker maps CI environments to identify high-value targets for follow-on compromise.