mw-test-utils@10.0.1

Summary

The package ships no functional code (index.js exports an empty object) but defines preinstall and postinstall lifecycle scripts in package.json that run inline node code to issue HTTP GET requests to http://38.242.235.206/depconf/mw-test-utils/preinstall and /postinstall. Each request carries the installer's USER/USERNAME environment value, the OS hostname, and the current working directory as query parameters. The requests fire automatically on every npm install, over plain HTTP, to a hardcoded bare-IP address with no TLS and no caller-configurable endpoint. The package name follows an 'mw-*' pattern consistent with internal-namespace collision, so any build that resolves this name from the public registry performs the beacon under the resolving organization's identity. The README frames the package as a dependency-confusion placeholder, but that self-labeling is author-controlled and does not constitute consent from installers whose builds resolve the name.

Source: amazon-inspector (bc25faf79aac980e4d025884748dc85b4e3b91f5e2582f6ce245db88616dbd2b)