@design-system-coopeuch/web@999.0.4

Analysis

Dependency-confusion package (version 999.0.4) with a preinstall hook 'node cb.js'; the package also ships an identical cb-full.js. Both scripts gather host reconnaissance (hostname, install directory, output of 'id', 'uname -a', OS-release info, working directory, and all environment-variable names) and POST it as JSON to hxxp://157[.]173[.]126[.]113:8443/dep-confusion. C2/IOC: 157[.]173[.]126[.]113:8443, path /dep-confusion.