@mntv-analysis/workspaces-components@65.11.3

Summary

The package's package.json declares a preinstall script that executes index.js on every npm install. index.js issues an HTTPS GET to realwbx.com/ip.php with a hardcoded Authorization header, sending the installer's egress IP and install event to a host unrelated to the @mntv-analysis scope. The shipped code performs no other function; the package's only observable effect on install is this call-home. The combination of a stub package under an organization-looking scope, an install-time beacon to an unrelated third-party host, and a hardcoded auth token matches the dependency-confusion reconnaissance pattern used to tag installers of squatted internal names ahead of a follow-on payload.

Source: amazon-inspector (f8a87306f427c899479454084eb038b0e9690829b4cb142a0d88434d1c1f06cb)