MAL-2026-10234

The slds-lsp-client package was published to the npm registry by user 'click2ai' (maintainer email privatek3m@protonmail.com) as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization (a Salesforce SLDS / Lightning Design System language-server (LSP) tooling namespace) so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.

The package declares a preinstall hook ("npm install @sentry/node && node examples/verify.js") that executes automatically at npm install time, before any application code runs. The bundled examples/verify.js initializes the @sentry/node client against a hardcoded, attacker-controlled Sentry DSN with sendDefaultPii enabled, resolves the installing host's public egress IP address by requesting Cloudflare's /cdn-cgi/trace endpoint (using a spoofed desktop-browser User-Agent to bypass bot challenges), then deliberately triggers a runtime exception and captures it. Flushing the event beacons the collected host telemetry (public IP plus Sentry default PII such as hostname, OS username and runtime/environment metadata) to the attacker's Sentry ingest endpoint at o4510485815754752.ingest.us.sentry.io.

Each impersonated namespace in the campaign beacons to a distinct Sentry project ID, letting the operator attribute successful installs to specific victim organizations — behaviour consistent with a dependency-confusion reconnaissance beacon rather than legitimate error monitoring. The install-time payload is byte-for-byte identical across all packages published by this account, differing only in the package name and the target DSN. This package's beacon targets Sentry project 4511716882972672.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d1a204f1615398c380936de4d1e2603cab90300e0e7bc20770ffd0bbe693ce80) Package name presents as a Salesforce Lightning Design System / Language Server Protocol client, but the shipped code is a thin Sentry wrapper with no SLDS or LSP functionality. package.json declares a preinstall script that runs `npm install @sentry/node && node examples/verify.js`, which resolves the installer's public IP via a Cloudflare trace endpoint, attaches it as the Sentry user identity (sendDefaultPii:true), and triggers a forced exception so the event — carrying the installer's IP and host/error metadata — is uploaded on `npm install` with no consent. The Sentry DSN is hardcoded to an author-controlled project at o4510485815754752.ingest.us.sentry.io/4511716882972672 (DEFAULT_DSN in src/index.js). The exported init() also falls back to the same hardcoded DSN when a caller does not supply one, so consumers of the library additionally route their application error telemetry and default PII to the same author endpoint. The name/description mismatch combined with an install-time beacon fits an opportunistic install-time data-collection package targeting typos or misfires.