ap3-foundations-ui@99.0.1

Summary

The package's preinstall hook runs index.js, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.homedir(), process.cwd(), os.platform(), os.arch(), and process.env.CI) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587. The behavior fires automatically on npm install without caller consent. The package is published at version 99.0.1 under a name consistent with an internal/private namespace, matching the shape of a dependency-confusion beacon used to confirm successful name hijack in a target environment. The exfiltrated fields identify the installing host, user account, working directory, and CI status — information useful for targeting follow-on attacks against the organization whose build pulled the package.

Source: amazon-inspector (7469eefaab624821647b4e412c4ceac1f422d4857b8484767041fdc355398477)