black-spindle@999.0.0

Summary

black-spindle@999.0.0 declares a postinstall lifecycle hook in package.json that executes curl http://778e-181-63-25-28.ngrok-free.app/test on every npm install. The destination is a short-lived, anonymous ngrok-free.app HTTPS/HTTP tunnel unrelated to any declared publisher, contacted over plain HTTP with no pinning or verification. The shipped index.js is an empty stub, so the manifest's lifecycle hook is the package's entire effect: installing the package causes the installer's host to contact an attacker-controlled endpoint and discloses install-time metadata (source IP, timing, user-agent) to that endpoint. The 999.0.0 version and single-line postinstall-beacon shape are consistent with dependency-confusion / install-telemetry beaconing rather than a legitimate library.

Source: amazon-inspector (3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786)