unicocheck-ios@9.9.9

Analysis

On npm install, the preinstall hook executes a curl command that sends host system fingerprinting data to a remote webhook endpoint. The payload collects hostname, current username, working directory, OS kernel details (uname -a), and the HOME directory path, transmitting them as HTTP GET parameters to webhook[.]site/fe1246c2-ac04-4493-b223-fe34ba26b79f. The package is a stub — unpacked size 365 bytes — with no actual SDK code despite claiming to be an iOS biometric SDK, and is published at version 9.9.9 to induce dependency resolution over the legitimate package.