@design-system-coopeuch/web@999.0.3

Analysis

Preinstall hook executes cb.js, which collects system data including the output of the 'id' command and exfiltrates it via HTTP POST to attacker-controlled IP 157[.]173[.]126[.]113:8443/dep-confusion. Uses child_process.execSync and http.request to send the package name and system info to the external server. Dependency-confusion exfiltration pattern.