lychee-norm-cache @22.0.0

Summary

lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containing the package name, a timestamp, and the basename of INIT_CWD (the directory in which npm/npx was invoked) to a hardcoded callback URL at https://deepbounty.dd06-dev.fr/cb/<id>. The package has no install lifecycle scripts and the declared main entry is absent, so the beacon fires only when the bin is explicitly executed (typically via npx, or when this name resolves in place of an intended internal package). The data sent is minimal and non-credential (project directory name only); there is no exfiltration of environment variables, files, or secrets, no remote code execution, and no persistence. However, the package occupies a namespace that may collide with internal package names and silently emits installer-side context to a third-party host without consent.

Source: amazon-inspector (23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de)