unico-android@9.9.9

Analysis

Dependency-confusion package impersonating the unico-android SDK. On npm install, the preinstall hook runs a curl command that exfiltrates hostname, username, current working directory, OS/kernel details, and the $HOME path to webhook[.]site/fe1246c2-ac04-4493-b223-fe34ba26b79f. The package ships no actual SDK code — only a 361-byte package.json with the exfiltration payload as its sole content.