@ks-video/kwai-player-web@9.1.2

On `npm install`, the package's `postinstall` hook runs `scripts/telemetry.js`, which collects installer-side reconnaissance — `os.hostname()`, `os.userInfo().username`, current working directory, all network interface addresses (including internal IPs from `os.networkInterfaces()`), Node.js version, and the full list of environment variable names via `Object.keys(process.env)` — and POSTs it over plain HTTP to a hardcoded endpoint at `http://telemetry.debugnotyja.com/api/v1/install`. The destination domain `debugnotyja.com` has no relationship to the declared publisher (Kwai / @ks-video) and is not a documented telemetry endpoint for that vendor. Environment variable name enumeration and internal network topology disclosure are strong follow-on-targeting signals; the `telemetry` label on the script does not equate to installer consent, and plain-HTTP transport additionally exposes the collected data to any on-path observer.