pandafortunerush@10.0.0

Analysis

pandafortunerush (versions 1.0.0 and 10.0.0) ships no executable code — each tarball contains only package.json and a README. Both lifecycle hooks (preinstall and postinstall) execute an inline node command that sends an HTTP GET to a hardcoded IP address, 38[.]242[.]235[.]206, at the paths /depconf/pandafortunerush/preinstall and /depconf/pandafortunerush/postinstall. The query string carries the OS user name (process.env.USER / USERNAME), the machine hostname and the current working directory; the HTTP response is not read or acted upon. The path structure (/depconf/<package-name>/...) is the dependency-confusion callback shape, and the manifest declares version 10.0.0 with no functional entry point, so installing it as a dependency of an internal project name would run the callback on every install. The manifest description and README describe the package as a defensive research placeholder for an internal project name exposed through a public package.json; that self-description is the publisher's claim and the observed behaviour is the install-time callback above. The data sent is limited to the user name, hostname and working directory — no environment variable values, token files, SSH/AWS credentials or file contents are read or transmitted by these hooks.