unico-check@9.9.9

package.json declares a preinstall lifecycle hook that runs `curl` against `https://webhook.site/fe1246c2-ac04-4493-b223-fe34ba26b79f`, passing the installer's hostname, current user, working directory, full `uname -a` output, and `$HOME` as query parameters. The beacon fires automatically on `npm install` with no user interaction. The package ships no source files, declares no main entry, and uses the implausible version `9.9.9` — the canonical shape of a dependency-confusion / typosquat reconnaissance package targeting builds that may resolve a private `unico-check` from the public registry. The package's only effect on installation is to leak host identifiers to an anonymous, attacker-controlled webhook.site bin, staging follow-on compromise. ## Source: ossf-package-analysis (61af12e58a8af18142c41410d07328ba0dbfb7e79b145d84b2389444c27b2abc) The OpenSSF Package Analysis project identified 'unico-check' @ 9.9.9 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.