MAL-2026-12512 Malicious code in appsignal (npm)

Package name appsignal shadows the legitimate @appsignal/* scope and is published at version 9999.0.0, a version-number pattern used to outrank private/internal dependencies during resolution. A preinstall script runs automatically on npm install and issues an HTTP GET to the hardcoded bare-IP endpoint http://75.119.137.232:31337/depconfuse, carrying the installer's os.hostname(), os.userInfo().username, process.cwd(), npm_config_registry, and CI repository-slug environment variables (GITHUB_REPOSITORY, CI_PROJECT_PATH, BUILD_REPOSITORY_NAME, BITBUCKET_REPO_FULL_NAME, TRAVIS_REPO_SLUG, DRONE_REPO, BUILDKITE_PIPELINE_SLUG, CIRCLE_PROJECT_REPONAME, JOB_NAME) as query parameters. The endpoint path /depconfuse, the bare-IP destination, the 9999.0.0 version, and the shadowing of an established scope indicate a dependency-confusion reconnaissance probe designed to identify internal build systems that resolve the public name over an intended private package.