0vulns-dependency-confusion-poc@1.0.0

The package communicates with a domain associated with malicious activity. --- ## Source: amazon-inspector (3d282025fb2ec1b4012e3b979cec1f66520e643fcadfd2864e54989de50dd00d) The package.json preinstall script runs `wget` against an attacker-controlled webhook.site URL, passing `$(whoami)`, `$(pwd)`, and `$(hostname)` as query parameters, executing automatically on `npm install`. This matches the npm-lifecycle-external-fetch and credential/telemetry exfiltration patterns (findings a static pattern match, a static pattern match, a static pattern match, a static pattern match, a static pattern match). the analysis confirms contextually that the script performs reconnaissance exfiltration to a non-registry collector, and config.unsafe-perm is set to ensure execution. the analysis further notes that the declared main entrypoint is missing and the tarball contains only package.json — the package exists solely to trigger the beacon, with no legitimate runtime functionality. Self-identification as a 'PoC' does not change the risk to an unintended installer (e.g., via dependency confusion).