datacamp-light@1.0.0

Analysis

This package masquerades as a lightweight DataCamp utility but exists only to fingerprint the host at install time. Its package.json registers a postinstall script that runs install.js, which collects the machine hostname, the current username, the user home directory, the OS platform, the current working directory, and a timestamp. It serializes this data to JSON and sends it via an HTTPS POST to a hardcoded remote endpoint (dc.iam.c.noratomo[.]asia/install), explicitly disabling TLS certificate validation so the exfiltration succeeds even against an attacker-controlled or self-signed server. The package main module (index.js) is an empty stub with no genuine functionality, confirming the package is purely a host-reconnaissance beacon.