rn-push-provisioning@99.0.1

One or more suspicious static signals were detected.

npm installation triggers the preinstall lifecycle hook.

A package install leaks identifying system and user information without consent.

Install-time host metadata collection and network exfiltration.

The package runs beacon.js before installation completes. That script reads the hostname and current local username, adds platform and architecture details, then sends the resulting query string to an IP-address endpoint and an unrelated HTTPS host. Errors are ignored, so the package does not surface the transmission to the installer.

This is confirmed unconsented install-time collection and exfiltration of local system and user metadata. The empty runtime entrypoint does not mitigate the malicious lifecycle behavior.