@demica/resources@99.99.100

Summary

On npm install, the package's scripts.postinstall executes canary.js, which issues an unconditional plain-HTTP GET to the hardcoded bare IP 157.230.17.236 on port 80 at path /dc?.... The query string includes os.hostname() (truncated to 200 chars) plus the package name, version, a nonce, and a phase identifier. This fires automatically on every install with no opt-out. The package self-describes as a 'dependency-confusion canary,' but it is published on the public npm registry under the @demica/* scope: any installer that resolves @demica/resources — including via accidental dependency confusion, typo, or curiosity install — will leak their hostname to the operator of that bare IP over unencrypted HTTP. The destination is an anonymous bare IP with no associated domain, publisher, or disclosure; hostname is an installer-side host identifier transmitted off-host to an attacker-shaped endpoint.

Source: amazon-inspector (98805b03541bafd28883acb75e8fd9d0e4ea947d75062563c34438dec82139bf)