wm-pause-lib-after-storage@1.0.0

Analysis

This package contains no legitimate functionality. On load, index.js shells out to read the local /etc/passwd file into a temporary file, then uploads that file via an HTTP POST to a hardcoded remote IP address on a non-standard port. The current username and hostname are embedded in the request URL path, leaking system identity alongside the password-file contents to an attacker-controlled server.