MAL-2026-16051

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7ce44bf9d1ffcc0a63fbc4e955c97cbd45f928e90ba052c49d4cce211b7fed96) @umschool/analytics@999.0.0 ships a postinstall.js that runs automatically on `npm install`. The script collects `os.hostname()`, `os.userInfo().username`, `os.platform()`, `process.cwd()`, and `process.version`, base64-encodes the payload, and sends it via HTTPS GET to the hardcoded third-party callback host `akko.requestcatcher.com` at path `/dep-confusion?data=<encoded>`. The implausibly high version number (999.0.0) under an organization scope is the standard dependency-confusion resolution-hijack shape: any build system configured to resolve `@umschool/*` from the public registry will fetch and execute this beacon, disclosing internal host identity and working-directory paths to an author-controlled endpoint. The package self-labels as a proof-of-concept, but the code executes the exfiltration unconditionally.