@zmtcdn/ui@9999.0.7

Summary

The postinstall.js lifecycle script runs automatically on npm install and collects installer-identifying data — os.hostname(), os.platform(), os.userInfo().username, process.cwd(), the list of process.env key names, and a timestamp — then POSTs the JSON blob via https.request to the hardcoded endpoint https://www.hinny.shop/api. The package name uses a vendor-style scope (@zmtcdn/ui) and an implausibly high version (9999.0.7) consistent with a dependency-confusion lure, and the fetch destination is unrelated to any declared publisher. No user opt-in, no documentation of the beacon, and no legitimate functional purpose for sending this data off-host at install time.

Source: amazon-inspector (e648b4f06d9e84a66379d2b099f89a9d669aa5f21f0159ceed861a37c590262f)