@umschool/analytics@999.0.1

Summary

@umschool/analytics@999.0.0 ships a postinstall.js that runs automatically on npm install. The script collects os.hostname(), os.userInfo().username, os.platform(), process.cwd(), and process.version, base64-encodes the payload, and sends it via HTTPS GET to the hardcoded third-party callback host akko.requestcatcher.com at path /dep-confusion?data=<encoded>. The implausibly high version number (999.0.0) under an organization scope is the standard dependency-confusion resolution-hijack shape: any build system configured to resolve @umschool/* from the public registry will fetch and execute this beacon, disclosing internal host identity and working-directory paths to an author-controlled endpoint. The package self-labels as a proof-of-concept, but the code executes the exfiltration unconditionally.

Source: amazon-inspector (7ce44bf9d1ffcc0a63fbc4e955c97cbd45f928e90ba052c49d4cce211b7fed96)