aftermath-finance @99.0.0

Summary

The package's preinstall script (setup.js) enumerates process.env and selects keys matching credential-shaped patterns (key/secret/token/pass/auth/private/drone/gitea/sui/admin/deploy), collects host identity (os.hostname(), os.userInfo().username, process.cwd(), /etc/hostname) and source-repo identifiers ( git remote -v ), and POSTs the collected data over HTTPS with TLS verification disabled (rejectUnauthorized: false) to the hardcoded bare IPv4 endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf. The behavior fires automatically on npm install via the preinstall lifecycle hook.

Source: amazon-inspector (2ee11a2b0ba5e782bbb8b4a0c92881a1f401916fb85e0621c56f6db370490058)