gaarf-bq@1.0.0

Analysis

The package runs a postinstall hook (postinstall.js) that collects host metadata — hostname, platform, architecture, Node.js version, and the npm lifecycle event — and POSTs it as JSON over HTTPS to vpx0x956[.]instances[.]poc[.]jchunt[.]top:443 at path /gaarf-bq. The beacon fires automatically on install, suppresses connection errors, and times out after 3 seconds. The package describes itself as a security-research canary but provides no repository or program reference to substantiate that claim.