martinez-polygon-clipping-tony@0.9.5

Package name impersonates the legitimate martinez-polygon-clipping library: README, badges, and API surface are copied verbatim, while repository points at an unrelated user (daltonchristiano060-gif/dalton-martinez). On `npm install`, scripts/postinstall.js fetches a platform/arch-specific binary from a hardcoded RFC1918 endpoint over plain HTTP (`http://10.10.6.129:8787/droppers/<os>-<arch>` or `/droppers/windows.exe`), writes it to os.tmpdir() or `c:/users/public/windows.exe`, chmods 0755, and spawns it detached with stdio ignored. There is no integrity verification, the URL is mutable, and a polygon-clipping library has no legitimate need for a native binary. Before fetching, the script enumerates environment variables and Linux DMI strings to detect GitHub Actions, GitLab CI, CircleCI, Buildkite, Travis, Vercel, Netlify, Kubernetes, AWS Lambda/ECS/Batch/EC2, Azure, and GCP, returning early in those cases — selective execution that targets developer workstations and hides from automated scanners. The combination of typosquat + install-time arbitrary-binary dropper + CI/cloud evasion is unambiguously a targeted attack on developer machines.