dc-renewals-layout2@9999.0.0

Analysis

dc-renewals-layout2@9999.0.0 is a dependency-confusion package that exfiltrates system and CI/CD environment metadata on install. The preinstall hook (node callback.js) collects the hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME) and sends them as HTTP GET query parameters to 75[.]119[.]137[.]232:31337 at the path /depconfuse. The package name mimics an internal enterprise utility and uses version 9999.0.0 to win version comparison in auto-merge scenarios.