hs-locale-management @99.99.99-poc3

Summary

Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal hs-locale-management namespace, published at the high-watermark version 99.99.99 to outrank any internal release during npm resolution. The postinstall.js script collects local host fingerprint data (os.hostname(), os.userInfo().username, platform, node version, pid) and prints it to stdout — it does not exfiltrate over the network, drop additional payloads, read credentials, or modify the installer's filesystem outside its own package directory. Installer impact in this version is limited to a harmless console print during npm install . The supply-chain concern is structural: any HubSpot build pipeline (or third party who mistakenly resolves this name from the public registry) executes this package's lifecycle scripts, and the same publishing position can be reused to ship arbitrary code in a future version. Routing to human review per policy on namespace-abuse / squat-name packages — present-version harm does not meet the block bar, but the squat itself warrants maintainer or registry-side action (takedown / namespace reservation).

Source: amazon-inspector (2adb7ba5ebcb66930ae574353088696c939ed6e677c12437e78de7166e96b932)