notafollower1@1.0.0

Analysis

The postinstall hook reads the ECS container metadata endpoint (ECS_CONTAINER_METADATA_URI_V4/task, exposing task ARN, cluster, and container environment) and POSTs the response to the attacker-controlled host hxxps://mourner-slot-explicit[.]ngrok-free[.]dev via curl. The package contains no other code or functionality — it exists solely to exfiltrate container metadata to a remote tunnel on install.