jshelperdependenceny@99.0.0

Analysis

This package is a dependency-confusion proof of concept: its name is a near-miss spelling of an internal package and it is published at version 99.0.0 so that public-registry resolution outranks the internal v1.0.0. Its preinstall hook (node preinstall.js, with errors suppressed via "|| true") prints a warning banner and POSTs a JSON beacon to a configurable callback URL — default hxxp://127[.]0[.]0[.]1:5656/exfil, overridable via the DC_CALLBACK_URL environment variable, with a commented hxxps://webhook[.]site example in the source. The beacon body contains only the package name and version, hostname, platform, architecture and a timestamp. No environment values, credentials, tokens, files or wallet data are collected or transmitted, and no commands are executed; the remaining module code is a small date/sanitize/id utility.