relativity-pdfjs-dist@99.9.9

High-risk behavior combination matched malicious policy.

npm installation, before package installation completes

Unconsented disclosure of host identity, username, working directory, registry, and CI/project context.

preinstall environment harvesting and HTTPS GET exfiltration

`package.json` executes an inline `preinstall` script automatically during npm installation. The script gathers local host, user, directory, registry, CI, GitHub repository, and Jenkins values, base64-encodes them, then transmits them as a query parameter to an external OAST domain while swallowing errors. The declared runtime entrypoint is inert, so this network collection is unrelated to package functionality.

Source inspection confirms concrete automatic install-time metadata exfiltration to an unrelated external endpoint. This is malicious behavior, not a benign package setup action.