dpdgroup-css@2.0.1

One or more suspicious static signals were detected.

npm preinstall or postinstall

Discloses the installing machine's hostname to a researcher-controlled endpoint.

install-time host identifier exfiltration over HTTP

During npm installation, both preinstall and postinstall invoke setup.js. It obtains os.hostname(), sanitizes it, then performs an HTTP GET to 89.116.25.133:4444 with the hostname in both the request path and X-PoC-Host header. The package's stated PoC purpose does not establish user consent for this automatic disclosure.

Direct source inspection confirms automatic install-time network exfiltration of a host identifier. Although limited in scope, it is concrete behavior rather than a scanner-only signal.