efhthrthrthregerht@99.9.9

Analysis

The package runs a postinstall hook that executes index.js on install. The script fingerprints the host — collecting the OS username, current working directory, hostname, and local IPv4 address — and POSTs this metadata as JSON to the external endpoint hxxps://webhook[.]site/f9bff304-3053-4d54-be05-86537267514a. Host identity and network information are exfiltrated to a third-party webhook on every install.