opentracing-shim@55.33.111

Analysis

opentracing-shim@55.33.111 is a combosquat of the opentracing namespace using an extremely high version number (55.33.111) on a zero-description package. Its postinstall hook runs a fingerprinting payload that collects hostname, platform, architecture, and timestamp, storing them in a hidden directory (~/.local/share/package-install or AppData\Proofs\package-install) alongside a dropped helper script. This is a staged reconnaissance implant: host-metadata collection on install as a first step that could be followed by exfiltration or a second-stage download.