syft-acp-uikit @1.9.45

Summary

The package declares a preinstall script that runs examples/verify.js, which initializes @sentry/node against a hardcoded author-controlled Sentry DSN (https://e82e1244d311e1f83fd57d89db4d62a3@o4510485815754752.ingest.us.sentry.io/4511744089718784), fetches the installer's public egress IP via https://www.cloudflare.com/cdn-cgi/trace, triggers an error, and flushes a Sentry event carrying the resolved IP to the author's project on every npm install. src/index.js additionally hardcodes the same DSN as DEFAULT_DSN and sets sendDefaultPii: true, so consumers who call init() without an explicit dsn silently route their captured error events and PII to the same author-controlled destination. The package name evokes the unrelated 'syft' ecosystem and a UI toolkit while its actual code is a thin Sentry wrapper against an author-owned DSN, and the README is a two-line stub — a name/behavior mismatch consistent with an impersonation lure.

Source: amazon-inspector (694d28b5d3d4fc19b2dc3399b982cc5333b4bc73fcdd45754194e9689737ee18)