backoffice-charges-module@1.999.0

Analysis

On installation the package runs a preinstall script that automatically executes a bundled script. The script collects host reconnaissance — the package name, a randomly generated execution identifier, the Node.js version, OS platform, and CPU architecture, plus a timestamp — and sends it as a JSON POST to a hardcoded remote endpoint. The package ships no real functionality (the file named as its main entry point is absent); its only behaviour is the install-time outbound beacon. The inflated version number is consistent with a dependency-confusion attempt to override an internal package of the same name.