masterkrweb@9.9.9

Analysis

TRUE POSITIVE: masterkrweb@9.9.9 is a host-fingerprinting malware beacon. Preinstall hook runs `node index.js` which exfiltrates os.hostname() and os.userInfo().username via HTTP GET to hardcoded IP 185[.]225[.]232[.]206/?h={hostname}&u={username}&pkg=masterkrweb. Package version is 9.9.9 (attacker pattern to surface above legitimate versions), description is the generic "Reserved package", publisher is a gmail address with no repository URL. Tarball scan confirmed the payload. No token-theft markers found but the hostname/username exfil to a raw IP is sufficient for classification as a credential-harvesting recon beacon. Not a benign research artifact — no research provenance or disclosure.