faceplate-docs@99.9.9

Analysis

The postinstall hook runs index.js, which collects host metadata — the installing user's username, current working directory, hostname, and local IPv4 address — and POSTs it as JSON to the attacker-controlled endpoint hxxps://webhook[.]site/f9bff304-3053-4d54-be05-86537267514a. The package has no other functionality.