ap3-foundations-uinpm

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working directory, platform, architecture, and CI flag to https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587. The npm account vikkuthetester22 published it on 2026-10-12.

The package's preinstall hook runs index.js, which collects installer host identifiers (os.hostname(), os.userInfo().username, os.homedir(), process.cwd(), os.platform(), os.arch(), and process.env.CI) and POSTs them as JSON to a hardcoded third-party collector at https://webhook.site/7dbd5e4e-3156-427f-b383-30c14d845587. The behavior fires automatically on npm install without caller consent. The package is published at version 99.0.1 under a name consistent with an internal/private namespace, matching the shape of a dependency-confusion beacon used to confirm successful name hijack in a target environment. The exfiltrated fields identify the installing host, user account, working directory, and CI status — information useful for targeting follow-on attacks against the organization whose build pulled the package.