dependency_confusions@99.9.9

Analysis

Dependency-confusion package (name "dependency_confusions" at version 99.9.9) with a postinstall hook that runs index.js. The script collects the installer's username, hostname, current working directory, local IP address, and platform, then POSTs this data as JSON to webhook[.]site/264e1903-28ea-48ea-8c55-be58c5a76791. The webhook[.]site service is a third-party webhook receiver commonly used for data exfiltration.