@birbalo/aliftech-ui@99.9.9

Analysis

The postinstall hook (node postinstall.js) reads the hostname and the current OS username and sends them to an attacker-controlled webhook at hxxps://webhook[.]site/539f8bb9-497a-4104-92f7-f95a77204cc2/{hostname}/{username} via an HTTPS GET on every install. The package is a 699-byte stub published at version 99.9.9 with no real UI code, so the sole purpose of the install hook is to collect and exfiltrate host/user metadata to the remote webhook.