rn-push-provisioning @99.0.1

Summary

The package's package.json declares a preinstall lifecycle script ( node beacon.js || true ) that runs automatically during npm install . beacon.js reads os.hostname(), os.userInfo().username, process.platform, and process.arch and sends them via https.get to the hardcoded endpoint https://m3p49wwj8ttzz98h.datasafeservices.com/npm-install?<query>. The package is published at version 99.0.0 with a name consistent with a dependency-confusion lure targeting installers who resolve an internal name to the public registry. Collected identifiers fingerprint the installer's host and user account and are transmitted to a third-party subdomain unrelated to any documented publisher, satisfying the install-time exfiltration fingerprint.

Source: amazon-inspector (77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023)