strict-engine-peer

On `npm install`, the package's preinstall hook (`preinstall: node index.js` in package.json) executes index.js, which reads the installer's project directory via `process.env.INIT_CWD`, takes its basename as `safeProjectName`, and POSTs a JSON payload containing that name and a timestamp to a hardcoded callback URL `https://deepbounty.dd06-dev.fr/cb/d9b7e171-33a4-49c7-aa79-c95794030d3b`. The package self-describes as a 'Security PoC for Bug Bounty' / 'Harmless dependency confusion PoC', and the name `strict-engine-peer` is consistent with squatting an internal/private package name on the public npm registry. Any developer or build system that resolves this package — typically by accident, via dependency confusion against an internal package of the same name — silently discloses the existence and name of an internal project to the third-party endpoint. The 'research' framing does not change the installer-side impact: unconsented network beacon at install time, leaking organizational metadata to an attacker-controlled host.