mw-communication-client@10.0.0

Summary

mw-communication-client is a dependency-confusion placeholder targeting a private 'mw-' scoped name. index.js exports an empty object; the package has no functional code. Both preinstall and postinstall lifecycle scripts issue plain-HTTP GET requests to the hardcoded bare IP 38.242.235.206 at paths /depconf/mw-communication-client/preinstall and /postinstall, sending the installer's OS username (process.env.USER / USERNAME), hostname (os.hostname()), and current working directory (process.cwd()) as query parameters. Any build that resolves this public name instead of the intended private package automatically beacons identity and internal path information to the third-party endpoint on npm install, disclosing which organizations and build environments are susceptible to dependency confusion on this name. The 'benign PoC / bug bounty' self-labeling in the package description does not change the behavior: the installer's identity and workspace path leave the host to an attacker-controlled destination without consent.

Source: amazon-inspector (156130368566461b338a19475fd466deaf8e4de6b866246f79a7faf190502141)