MAL-2026-16061

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1fed7c0ff512ccb2e87647a41a92653138ff50b2be906043aba86ce76b49e340) The package's postinstall script (beacon.js), also re-executed on require via index.js, sends the installer's hostname, run identifiers, and the output of the `id` shell command to a hardcoded third-party collector at https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b over HTTPS. The same script probes the GCP instance metadata service at 169.254.169.254 and metadata.google.internal with the `Metadata-Flavor: Google` header and reports the status and body back to the webhook, disclosing whether the install environment is a cloud VM and what IMDS returns. Data leaves the installer's host to an attacker-controlled collector automatically on `npm install` and on `require()`, without consent.