Suspicious 80% Download

2c/98/2c98bdeb0dc87959a9e2406250a8a44184b93c7c44cb6a2d28a3b99c481f3e31

preinstall hook collects user info

Filename is package.jsonManifest declares npm preinstall lifecycle hook
SHA-2562c98bdeb0dc87959a9e2406250a8a44184b93c7c44cb6a2d28a3b99c481f3e31

Evidence

Tiny package.json manifest lines 1–10
1{
2 "name": "env-checker",
3 "version": "2.0.0",
4 "description": "Logs the installing user for diagnostics",
5 "repository": "https://github.com/example/env-checker",
6 "license": "MIT",
7 "scripts": {
8 "preinstall": "echo installing as $(whoami) on $(hostname)"
9 }
10}

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.