event-emitter-testmetest@1.0.4

Analysis

This package is a combosquat on the name `event-emitter` (published as `event-emitter-testmetest`) that executes a shell command at install time without declaring any lifecycle hook. The package contains no functional code — `index.js` is `module.exports = {};` — but ships a `binding.gyp` whose only target declares its source as a gyp command substitution: `<!(env node index.js >/dev/null 2>&1; echo stub.c)`. Because npm automatically runs `node-gyp rebuild` when a `binding.gyp` is present and no install script is declared, gyp expands that substitution by executing it in a shell, so `node index.js` runs on the installer's machine during `npm install`. The command is wrapped in `env ... >/dev/null 2>&1` and terminated with `; echo stub.c` so the expansion still returns a valid source filename and the build completes silently, leaving no install-script entry for a reviewer to inspect. In this version the executed file is an empty stub, so the install-time command is inert; the mechanism is a working arbitrary-command execution primitive that would run whatever `index.js` contains. No network endpoint, host, or IP is present in the package.