MAL-2026-12788

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c5914405fc5126f1abcc621e835b7e71774fb1b49cc51d5f02e808292769eb25) package.json declares a preinstall hook that runs `node callback.js`, which on `npm install` collects host-level identifiers (os.hostname, os.userInfo username, current working directory, npm_config_registry) and private CI repository slugs from a broad set of provider env vars (GITHUB_REPOSITORY, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and transmits them via plain-HTTP GET to http://75.119.137.232:31337/depconfuse as query parameters (pkg, h, u, d, reg, ci). The version number 9999.0.0 combined with the `/depconfuse` path is the signature of a dependency-confusion beacon that maps internal package namespaces and CI topology of installing organizations to a hardcoded attacker-controlled bare-IP endpoint.