MAL-2026-12395 Malicious code in jquery.ui.tabs (npm)

[email protected] is a dependency-confusion squat: it is published at version 9999.0.0 with an empty runtime (index.js contains only module.exports = {}) and a preinstall lifecycle hook that runs node callback.js. On npm install, the preinstall script collects os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and a sweep of CI repository-identifier environment variables (GitHub, GitLab, Azure, Bitbucket, Travis, Drone, Buildkite, Circle, Jenkins) and sends them as query-string parameters over plain HTTP to the hardcoded bare-IP endpoint http://75.119.137.232:31337/depconfuse. The 9999.0.0 version and empty main are consistent with a probe designed to outrank an internal jquery.ui.tabs package in mixed registry resolution and report back which organizations resolve the public name, exposing internal hostnames, usernames, working directories, and private repository slugs to an attacker-controlled host.