es6-migrator@1.0.0

One or more suspicious static signals were detected.

npm installation invokes the preinstall lifecycle hook.

A remote operator receives identifying information and the working directory without the installer invoking a package command.

Install-time host, user, and path exfiltration over HTTP with DNS fallback.

During npm installation, the preinstall hook runs beacon.js. The script obtains the machine host name, operating-system user name, and current working directory, encodes them, and sends them as HTTP headers to a remote callback. If that request fails, times out, or receives a non-success response, it performs DNS queries whose names contain the same encoded data. The collection occurs without an explicit package command from the installer.

This package performs unconsented install-time collection and network exfiltration of host identity, user identity, and install-path data. Its embedded research-purpose statements are not sufficient to make this behavior safe for upstream installation.