bulk-add-sdk@1.99.99

Analysis

The install hook runs `node extract.js thd-orangepay`. The script performs host reconnaissance and exfiltrates it to an attacker-controlled domain: it resolves a DNS beacon name of the form `<project_id>.<hostname>.da70vavqatj0sujmhl70w1anmx5ghcr13[.]wallclip[.]me`, fetches the machine's public IP from ifconfig[.]me, then POSTs a JSON payload containing hostname, platform, architecture, current working directory, public IP, and project_id to that wallclip[.]me host over HTTPS (with X-Host, X-Platform, X-Arch, X-CWD, X-IP, X-Project headers). The beacon fires on package install.