jshelperdependenceny@99.0.0

Summary

npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 package of the same name — the classic dependency-confusion shape of using an inflated version to win resolution against a private registry. On install, package.json runs 'node preinstall.js || true', which collects os.hostname(), os.platform(), os.arch(), and the package name/version and POSTs them as JSON to a URL taken from the DC_CALLBACK_URL environment variable, defaulting to http://127.0.0.1:5656/exfil. The env-var override turns the loopback default into a functional attacker-configurable beacon that fires automatically on npm install and discloses installer host identifiers plus confirmation that the shadowed internal name resolved to this public artifact.

Source: amazon-inspector (dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9)