ecobee-api @0.0.2

Summary

On npm install , ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint http://169.58.96.170:9001/cb, passing the installer's hostname (os.hostname()) and the package name as query parameters. The package ships no functional library code — package.json declares an UNLICENSED 'Utility package' with a name resembling the Ecobee vendor, and the only substantive shipped file is the beacon. This is the shape of a dependency-confusion / typosquat recon beacon: it confirms install-time code execution on the victim host and identifies the host to the operator of 169.58.96.170 over plain HTTP.

Source: amazon-inspector (bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f)