ecto-spirit-win-k4n8 @1.0.0

Summary

The package ships a postinstall.js that imports child_process and references HTTP GET and hostname operations. Without traced-code corroboration of how these primitives are composed (e.g., whether GET fetches attacker-controlled content that is then executed, or whether hostname is exfiltrated to a remote endpoint), the pattern is consistent with both benign install diagnostics and an exfil/dropper shape. Manual review of postinstall.js is needed to confirm intent before publishing a verdict.

Source: amazon-inspector (8082c12f69dfbb45e83017fa0baf4f88f9500649dd443e80f2d7d4f858020814)