Purpose-built dependency-confusion artifact published under an internal-style package name at version 99.0.0. Both preinstall and postinstall execute a bundled beacon that collects the build host's hostname, username and current working directory and transmits them off-host over two independent channels; the module itself exports nothing. Self-described as authorized research, but the collection and transmission are unauthorized in any consuming build.