syft-acp-atoms @14.8.68

Summary

On npm install, the package's postinstall hook ( node./beacon.js ) collects the installer's hostname, OS username, and current working directory via os.hostname(), os.userInfo(), and process.cwd(), hex-encodes them, and transmits them as a query string to https://exzotiqq.com/ via https.get. The package ships no library code — the declared main: index.js is absent from the tarball — so the only effect of installing the package is to run the beacon. Behavior is consistent with a reconnaissance / dependency-confusion probe.

Source: amazon-inspector (74ddca6430f87ddf8a19eed0ed269e147b577c055d399bec7ca1fed6fa1d75f1)