@mexc/ws@1.0.1

High-risk behavior combination matched malicious policy.

npm postinstall during installation

Creates an unconsented local artifact containing hostname, username, working directory, platform, and time.

install-time host metadata collection and temporary-file write

Installing the package runs an inline Node postinstall hook. It gathers host and environment metadata and writes it to mexc-confirmation-dios.txt in the operating system temporary directory. The manifest explicitly frames the package as a dependency-confusion proof of concept; although it does not transmit data, the automatic collection and out-of-package write are concrete unconsented install-time behavior.

Source inspection confirms a postinstall side effect that collects local metadata and writes it outside the package, aligned with the package's dependency-confusion PoC description. Absence of networking limits impact but does not remove the malicious install-time behavior.