react-native-bright-sdk@9000.0.0

Summary

The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname() and an install timestamp, base64-encodes the JSON payload, and transmits it via HTTPS GET to the hardcoded endpoint https://estimator-nemeses-unwatched.ngrok-free.dev/canary. The destination is an anonymous, ephemeral ngrok tunnel unrelated to any legitimate publisher infrastructure, and the beacon fires automatically without user opt-in. The package ships no functional code justifying this network activity; it exists only to send the install signal. The version number (9000.0.0) and name resemble a dependency-confusion / namespace-reservation shape targeting internal package resolution.

Source: amazon-inspector (4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55)