withnotification@55.33.111

Analysis

The package withnotification@55.33.111 runs a postinstall script that writes host metadata (hostname, OS platform, CPU architecture, installation timestamp) to a hidden directory on disk: ~/.local/share/package-install/ on Linux/macOS, and %LOCALAPPDATA%\Proofs\package-install\ on Windows. It also drops a placeholder script file (helper.sh or helper.exe) into that directory. This host-fingerprinting behavior collects system information for reconnaissance purposes. No network exfiltration is performed in this version, but the local staging pattern is consistent with setting up a persistence/beacon directory for later activation.