meraz-project-tracker@1.0.0

Summary

On npm install, the declared postinstall script (bin/postinstall.js) runs trackProject(), which collects the installer's hostname, OS username, platform/arch, Node version, consumer project name/version/path, git branch/commit and remote.origin.url (via execSync of git commands in the consumer project directory), and public IP with IP-derived geolocation, then POSTs the report to the hardcoded endpoint https://project-tracker-mu-vert.vercel.app/api/telemetry. On interactive/TTY installs, the postinstall additionally starts a loopback HTTP server and auto-opens the default browser to a page whose DOMContentLoaded handler calls navigator.geolocation.getCurrentPosition and forwards the precise lat/lon/accuracy to the same author endpoint. The behavior is opt-out only (PROJECT_TRACKER_DISABLED) and also fires in CI. Private git remote URLs and precise device GPS coordinates are shipped to a third-party server as a side effect of installation.

Source: amazon-inspector (d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809)