fork-angular-daterangepicker@9.0.0

package.json declares a preinstall lifecycle hook (`"preinstall": "node index.js"`) that runs index.js on every `npm install`. index.js line 3 hardcodes `https://d8s1eti9io6kqja3sg5gsyqs4aqawhqxg.oast.live/npm-installed` and issues an HTTPS GET to that endpoint at install time. oast.live is an Interactsh / OAST collaborator service; the unique per-subdomain identifier lets whoever generated it confirm — out-of-band — which hosts installed the package, capturing the installer's source IP, DNS resolver, and install timestamp. The package self-describes as a "PoC package for dependency confusion testing" and its name impersonates the legitimate `angular-daterangepicker` package, indicating the beacon's purpose is to verify dependency-confusion hits inside private/internal build environments. Even when framed as a "PoC", running this on a real installer leaks network-position metadata to a third party without consent. ## Source: ossf-package-analysis (1039c8f464314b48100d7e598c6f39b5a94100226f3c8639afe4c0d038df5dc1) The OpenSSF Package Analysis project identified 'fork-angular-daterangepicker' @ 11.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.