consumerweb-risk@3.4.3

One or more suspicious static signals were detected.

npm installation, before normal package installation completes

Leaks the installing user's username, host name, and working directory to an external domain.

DNS-based exfiltration from a preinstall hook

On installation, the preinstall hook executes preinstall.js. It obtains the local username, hostname, and current working directory, serializes and hex-encodes them, then places the data in DNS subdomain labels and invokes dns.lookup against an external domain. The hook suppresses failures, making the activity quiet.

This is unconsented install-time collection and DNS exfiltration of host data, not a package-aligned setup action. The concrete lifecycle-triggered network behavior warrants blocking.