mx-www-protobuf@1.0.0

High-risk behavior combination matched malicious policy.

npm install

Unconsented install-time system-information collection and filesystem mutation.

postinstall host metadata collection and file drop

The manifest’s postinstall script automatically reads hostname, environment user name, working directory, platform, and time, then writes them to mexc-confirmation-dios.txt in the OS temp directory. The package identifies itself as a dependency-confusion proof of concept and has no functional implementation beyond a log message.

This is confirmed unconsented install-time metadata collection and file creation in a package explicitly positioned as a dependency-confusion PoC. Absence of network exfiltration does not make the lifecycle behavior benign.