krdpass-auth-react-native@10.0.0

Analysis

The package is a stub (index.js exports an empty object) whose preinstall hook runs a host-recon beacon. On install, preinstall.js collects the machine's hostname, username, home directory, platform/architecture, Node version, working directory, all non-internal network interface IPs, CI/CD environment details (GitHub Actions, GitLab, Jenkins, CircleCI, Travis, AWS CodeBuild, Azure DevOps), the parent project's package name/version/dependency count, and the names of environment variables matching TOKEN/KEY/SECRET/PASS/AUTH/CRED/AWS/AZURE/GCP/NPM/GITHUB/GITLAB/API, then POSTs this JSON to hxxps://webhook[.]site/5ba4d4a7-b977-4bb8-b26e-517b46271316. The README presents the package as a legitimate "KRDPASS Auth SDK for React Native" with no disclosure of this behaviour.