@woodpecker-web-shared/components@1.20.4

Analysis

On install, the package's main entry (index.js) collects host metadata — hostname, OS username, platform, architecture, current working directory, Node version, and the npm lifecycle event — and POSTs it as JSON to the webhook[.]site URL hxxps://webhook[.]site/d9bc4bcc-ce74-4193-ae4e-96d234bb2220. webhook[.]site is a third-party webhook collection service commonly used to harvest beaconed data. The package also declares a postinstall hook that invokes a main.js file not present in the tarball.