@azure-lab-services/ml-ts@99.0.0

Analysis

Dependency-confusion package using an Azure-style scoped name and an inflated 99.0.0 version. Its package.json registers a preinstall lifecycle hook that executes a bundled script on install. The script gathers host reconnaissance — hostname, OS platform and architecture, the install working-directory path, a timestamp, and the machine public IP (queried from an external IP-echo service) — and exfiltrates the collected data as a JSON message to a hardcoded Discord webhook. No legitimate functionality is present; the package exists solely to fingerprint and beacon hosts that auto-install it.