claude-channel-telegram@9.9.9

Analysis

The package runs a preinstall and postinstall hook that executes index.js, which reads the machine hostname and POSTs it to a remote webhook at eo8f3m3ho26a0nm[.]m[.]pipedream[.]net (path /claude-channel-telegram?h=<hostname>). The install-time beacon exfiltrates the hostname to an external webhook host on every install.