@zmtcdn/components@9999.0.0

Analysis

The scoped package @zmtcdn/components publishes a sentinel version (9999.0.0) containing only package.json, a 21-byte index.js stub and postinstall.js; package.json declares "postinstall": "node postinstall.js", so the script runs on every install. It builds a JSON payload from the build host — hostname, OS platform, local username, current working directory, ISO timestamp and Object.keys(process.env), i.e. the NAMES of every environment variable, which in CI environments include NPM_TOKEN, GITHUB_TOKEN, GH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, OPENAI_API_KEY, ANTHROPIC_API_KEY, STRIPE_SECRET_KEY, SLACK_TOKEN, DOCKER_PASSWORD, CI_JOB_TOKEN, GITLAB_TOKEN and HF_TOKEN — and POSTs it over HTTPS to hxxps://webhook[.]site/f52af355-4783-4acb-9de1-5e44b5963025. The script sends variable names and their presence, not their values, and reads no files. The same postinstall script with the destination hxxps://www[.]hinny[.]shop/api is shipped in the sibling package @zmtcdn/ui@9999.0.7.