service-roles-registry 99.0.2

Details

A dependency-confusion package published 2026-11-02 under an internal-looking name with an inflated 99.x version to win resolution over a private package. Version 99.0.2 ships a preinstall hook ('node index.js') that runs on 'npm install'; index.js reads the machine identity (os.hostname, os.userInfo) and the working directory and sends them by HTTPS POST to a public request-collection endpoint. Self-described as a dependency-confusion proof of concept. The earlier 0.0.0-stage and 99.0.1 versions ship no install hook. SHA-256 of the 99.0.2 index.js: ca719dd4b07aeddffaf59facde11726e981bad6d15620b47407f943ea00bb496.