simplewave 0.0.2

Details

The package runs a one-line Node.js command from its postinstall script. The command sends an HTTP GET request to a host name made of the machine's host name followed by a fixed random label under oast.fun, a public out-of-band interaction service, so the machine's host name reaches the operator through the DNS and HTTP lookup. It does nothing else. The package has no legitimate function: it belongs to a dependency-confusion beacon campaign.

Impact: the operator learns which machines install the package and their host names.

Remediation: remove the package from all projects and lockfiles and review the hosts that installed it.