mx-www-locales-common@99.0.0

Analysis

The postinstall hook runs a host-fingerprinting beacon. It collects the machine hostname, OS/platform/arch, CPU count, username, home directory, working directory, local IPv4 addresses, public IP (queried from ifconfig[.]me / api[.]ipify[.]org), and a broad set of CI and environment variables (GITHUB_*, GITLAB_CI, AWS_EXECUTION_ENV, npm_config_registry, HOME, PWD, USER, LOGNAME, and others), then exfiltrates the assembled JSON to hxxps://webhook[.]site/e97b40db-c35f-4f98-a2d4-3f94ad5fd668 and to a canarytokens URL (hxxp://canarytokens[.]com/images/traffic/1dgvcz6mx2ec0lb7jda73aujc/post[.]jsp) with hostname/IP/CI-vars/timestamp query parameters. It also writes the fingerprint to /tmp/mexc-confirmation-dios.txt. The package is a single-version 99.0.0 release masquerading as a MEXC internationalization-locales package.