@prime0/pcomatch@1.0.0

Summary

index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On npm install, the postinstall hook collects host identifiers (hostname, username, platform, arch, cwd, node version, pid, all non-internal IP addresses, uptime, package name) and POSTs them as JSON to /b. On require() of the package main, the module beacons the same host, then polls /c every 30 seconds for JSON commands and executes the c field via child_process.exec, POSTing stdout/stderr back to /r. A source comment self-identifies the module as a stealth typosquat agent, while package.json advertises only a generic "small utility" description.

Source: amazon-inspector (08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816)