MAL-2026-12394 Malicious code in jquery.ui.core (npm)

Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry (index.js) is empty (module.exports = {}); the only functional code is a preinstall script (callback.js) that runs automatically on npm install. On install, the script reads os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository-identifier environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME) and issues an HTTP GET to http://75.119.137.232:31337/depconfuse with those values as query parameters. The 9999.0.0 version, empty module body, hardcoded bare-IP over plaintext HTTP, and reporting of the configured npm registry plus CI repo slug are the canonical dependency-confusion reconnaissance shape used to identify internal build systems that mistakenly resolved a private package name to the public registry.