sm-admin@99.0.1

Package sm-admin@99.0.0 defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at http://16.192.173.5/sm-admin/pre and http://16.192.173.5/sm-admin/post. Installing the package causes the installer host to contact this endpoint, revealing that the internal-sounding name 'sm-admin' resolved on that machine and disclosing the installer's source IP to the operator of that endpoint. The destination is a bare IPv4 over cleartext HTTP with no relationship to any publisher, and the elevated version number (99.0.0) together with the callback shape is characteristic of a dependency-confusion probe against a private-registry name. The endpoint is attacker-controlled and unauthenticated, so the response body served to preinstall/postinstall could change at any time. ## Source: ossf-package-analysis (80e0a34b4b727bd2f26180a0ef6bca6ca81e6dfa5b011ff320f07f37c2d9369c) The OpenSSF Package Analysis project identified 'sm-admin' @ 99.0.1 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.