remote_session_elements@9999.0.0

Analysis

The preinstall hook (node callback.js) collects the hostname, username, current working directory, npm registry URL, and CI/CD environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME, and others) and exfiltrates them via an HTTP GET request to 75[.]119[.]137[.]232:31337/depconfuse. The package uses a high version number (9999.0.0) and a generic name to target dependency-confusion victims.