@feui-render/feui-render@99.0.0

Analysis

Package @feui-render/feui-render@99.0.0 is a dependency-confusion proof-of-concept published under an authorized bug bounty engagement. On install, the preinstall script (scripts/preinstall.js) sends a single HTTPS POST to callback[.]kuldeep[.]io/beacon containing the machine hostname, Node.js version, platform, package name/version, and a correlation nonce. No environment variables, credentials, tokens, or filesystem data are collected or exfiltrated. No shell execution, persistence, or additional downloads occur. The package is a placeholder to demonstrate that an internal package name resolves from the public registry.