digitalexp-style-module-l9@99.0.0

One or more suspicious static signals were detected.

npm package installation runs preinstall or postinstall.

Build-host username, hostname, and project working path are disclosed to an external domain.

lifecycle beacon exfiltrates host metadata via DNS and HTTPS

Both install lifecycle hooks invoke beacon.js without user action. The script reads the build machine hostname, username, and current working directory, encodes the combined data in a DNS hostname resolved beneath b0.rs, and also sends hostname and cwd in an HTTPS request to b0.rs. Its stated research purpose does not remove the unconsented install-time disclosure.

Direct source inspection confirms automatic lifecycle execution and two outbound channels carrying local build-host metadata. The behavior is concrete install-time exfiltration, regardless of the package's stated PoC intent.