@dgn-src-click-to-pay-org/srcdcfreleasecert@999.0.1

Analysis

The package's postinstall hook (scripts/check-env.js) runs on install and sends a covert host-metadata beacon to hxxp://16-171-38-148[.]sslip[.]io:8080/api/install (IP 16[.]171[.]38[.]148:8080). The JSON payload contains the package name/version, the installer's operating system platform, CPU architecture, and Node.js version. This network callback is undocumented and unrelated to the package's declared payment-utility purpose (amount formatting, PAN masking, Luhn validation). The endpoint can be redirected via the DGN_SRC_ENDPOINT environment variable.