field-plus@99.99.1

Analysis

Dependency-confusion stub. On install, both the preinstall and postinstall lifecycle hooks execute a curl command that sends the victim's username, hostname, and working directory to the hardcoded IP address 3[.]7[.]226[.]146 on TCP port 9000 via HTTP GET to the path /callback. The response is discarded and the exit code is swallowed (redirected to /dev/null with `|| true`), making the beacon silent to the installer. The package ships no functional code — only a package.json containing the hooks at version 99.99.1, a sentinel version chosen to take priority over the legitimate field-plus package in automatic resolution.