@ravespaceio/browser-input@99.0.1

Analysis

This package contains no real functionality (it exports an empty object). On installation it runs a preinstall lifecycle script, and on import it runs an execSync call, both invoking curl against a hardcoded remote host (173[.]249[.]29[.]170 on port 1337). The unusually high version (99.0.1) on a scoped package name is consistent with a dependency-confusion attack: by publishing a high version under an internal-looking package name, the author tricks build systems into pulling this package instead of a private one, and the install-time callout acts as a beacon confirming the package was installed and leaking that the targeted private name resolved to this host.