tetotest@14.0.0

Analysis

The package contains no application code — only a package.json whose preinstall and postinstall hooks run during installation and POST host metadata to an attacker-controlled Discord webhook (hxxps://discord[.]com/api/webhooks/1413937656697720862/[.][.][.]). The preinstall hook sends the current working directory ($(pwd)); the postinstall hook sends the device hostname ($(hostname)). Installing this package silently reports the installer's host identity to the remote webhook.