clover-codelab-remote-pay-cloud@99.9.9

Analysis

The package is a combosquat of the Clover payment platform name, published at version 99.9.9. Its postinstall hook runs index.js, which collects the installer's username, hostname, local IP address, and current working directory, then sends this data as a JSON POST to webhook[.]site/9aa13631-fbb0-4b6b-a256-27d1672f767c. The webhook[.]site service is a third-party HTTP request collector commonly abused for data exfiltration. No credentials or tokens are stolen, but the package silently exfiltrates system-identifying information on install.