@umschool/analytics@999.0.1

@umschool/analytics@999.0.0 ships a postinstall.js that runs automatically on `npm install`. The script collects `os.hostname()`, `os.userInfo().username`, `os.platform()`, `process.cwd()`, and `process.version`, base64-encodes the payload, and sends it via HTTPS GET to the hardcoded third-party callback host `akko.requestcatcher.com` at path `/dep-confusion?data=<encoded>`. The implausibly high version number (999.0.0) under an organization scope is the standard dependency-confusion resolution-hijack shape: any build system configured to resolve `@umschool/*` from the public registry will fetch and execute this beacon, disclosing internal host identity and working-directory paths to an author-controlled endpoint. The package self-labels as a proof-of-concept, but the code executes the exfiltration unconditionally.