@npmresearch4/bench-2c83@1.0.0

Analysis

The package run.js executes in preinstall, postinstall, and require() phases. It harvests all environment variables (including NPM_TOKEN, GITHUB_TOKEN, AWS_*, CI tokens), reads ECS IAM credentials from the 169[.]254[.]170[.]2 metadata endpoint, collects host/network/container metadata, and exfiltrates everything via HTTPS POST to elsewhere-visual-scales-even[.]trycloudflare[.]com/beacon. It also runs a DynamoDB permission audit against any accessible table (ListTables, DescribeTable, Scan, PutItem, UpdateItem, DeleteItem, Query).