sc-payment-utils @9999.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12801
Ecosystem
npm
Summary
sc-payment-utils@9999.0.0 declares a preinstall script that executes callback.js on npm install. The script collects host identity (os.hostname(), os.userInfo().username), the current working directory, the configured npm registry, and a battery of CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME), and issues an HTTP GET to a hardcoded bare-IP endpoint at http://75.119.137.232:31337/depconfuse with those fields as query parameters. The 9999.0.0 version number and beacon shape are consistent with a dependency-confusion reconnaissance callback targeting internal package names leaked into public registry resolution.
Source: amazon-inspector (78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.