@dsft/ft-element@2.5.9

Analysis

This package runs a preinstall lifecycle hook that executes automatically when the package is installed. At install time it reads the installing project's working directory and captures the project folder name, then sends that information together with a timestamp and the package name as a JSON POST request to a hardcoded remote callback URL. This is dependency-confusion beacon behaviour: install-time code execution that exfiltrates host/project identity to an external attacker-controlled server without consent.