@mntv-analysis/ui@99.1.1

Summary

The package's package.json declares a preinstall script that runs node index.js during npm install. index.js issues an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization header on every install, firing before any user code runs. The destination is unrelated to the declared @mntv-analysis scope and to any publisher-owned infrastructure, and the request's TCP source reveals the installer's public IP to that third-party host along with the hardcoded campaign token. The package otherwise ships a ~1KB index.js, a two-word README, and a vague description about IP/metadata lookup, providing no library surface that a consumer of a UI package would use. The shape is a victim-tagging install beacon inside a scope-styled lure, not a functional UI library.

Source: amazon-inspector (e19959148ce0529ebab1f6dbb0434f71b745b19d542d373b12577b208008ebfa)