MAL-2026-16062

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b93b70d19f6065f9757e39a5d7f799ca9cfff26e2c47b6e4c51012a104885578) Package @yongot/canary-mcp-test@2.0.0 ships beacon.js which runs `execSync('id')`, reads `os.hostname()`, and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes `node beacon.js postinstall`, so the beacon fires automatically on `npm install`. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.