b2b-frontend-external-library@9999.0.0

Summary

package.json declares a preinstall lifecycle script (preinstall.js) that runs on npm install. The script collects hostname, username, cwd, install path, platform/OS release, Node version, npm user-agent, and the resolved package name+version, then sends the data via a DNS lookup and two HTTP(S) POSTs to three hardcoded destinations: an OAST collector at dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online, a bare-IP HTTP endpoint at 5.189.159.252, and a URL under hackerone.com. The package name (b2b-frontend-external-library) and behavior match the dependency-confusion beacon pattern: any environment that resolves this public name during install unconditionally transmits identifying host and user information to third-party endpoints. Whether framed as bug-bounty research or not, the traced code performs unsolicited install-time collection and exfiltration of installer identifiers.

Source: amazon-inspector (09cca48cfb31563fd1eefa7c1d56c69ba1c8459a5089592884538d7b2cb7252b)