ach-detail@99.0.1

Analysis

The package runs a preinstall hook on install that beacons host metadata to a remote collector. It POSTs a JSON body containing the hostname, package name/version, Node.js version, platform, and timestamp to hxxps://callback[.]kuldeep[.]io/beacon (with an HTTP fallback to hxxp://callback[.]kuldeep[.]io/beacon). The package is published at version 99.0.1 on a name that collides with an internal package, and its README claims it is an authorized bug-bounty proof-of-concept; that claim is not independently verifiable and the beacon executes on every install regardless.