keroeltopgg@99.99.99

Analysis

The package's main entry point (index.js) reads the machine hostname and sends it to a remote webhook endpoint at eo8f3m3ho26a0nm[.]m[.]pipedream[.]net under the path /keroeltopgg, using the "requests" dependency. The package also declares a large set of lifecycle scripts (preinstall, install, postinstall, prepare, etc.) that only print placeholder messages. The hostname beacon exfiltrates installer host metadata to the attacker-controlled pipedream[.]net endpoint.