bender-rspack-config@1.0.0

Summary

package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $(whoami), $(pwd), and $(hostname) as query-string parameters. The request fires automatically on npm install, transmitting the installer's username, working-directory path, and hostname to an author-controlled collector at webhook.site/9d385aa8-875e-48b6-938c-6c0f5a0e8319/. The behavior is self-labeled as a dependency-confusion proof of concept, but the shipped code is a functioning identity-beacon regardless of framing.

Source: amazon-inspector (3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4)