localize-translate@1.0.0

Analysis

The package's postinstall hook (node postinstall.js) beacons host metadata to a remote endpoint on install. It collects the hostname, platform, architecture, Node.js version, and the npm lifecycle event, serializes them as JSON, and POSTs them over HTTPS to gigww0v7[.]instances[.]poc[.]jchunt[.]top:443 at path /localize-translate. The package name is a combosquat of the legitimate @angular/localize package. No credentials, environment variables, or files are exfiltrated; the payload is a host-fingerprinting beacon.