@test1230504/probe-7f3k2m-utils@1.0.0

One or more suspicious static signals were detected.

npm installation (postinstall)

Unconsented disclosure of host and account-identifying metadata.

shell command exfiltrates hostname and whoami via curl

On npm installation, package.json launches postinstall.js. That script executes curl and interpolates the installing machine's hostname and current username into a request to an external OAST endpoint, causing unconsented metadata exfiltration.

Direct source inspection confirms an install-time shell command that collects and exfiltrates host/user identifiers to a third party. The runtime utility entrypoint does not justify this behavior.