lab-services@99.0.0

Analysis

This package is a dependency-confusion squat (published at version 99.0.0 to outrank an internal package of the same name). Its package.json declares a preinstall hook that executes a bundled script on install. The script fetches the machine public IP from an external IP-echo service, then gathers host reconnaissance (hostname, public IP, current working directory, OS platform, CPU architecture and a timestamp) and POSTs that data as a JSON message to a hardcoded Discord webhook before exiting. Installing the package silently leaks identifying environment details to an attacker-controlled endpoint.