The npm package browser-metrics-plugin.contrib version 0.0.1 is a dependency-confusion package with a malicious install hook. package.json declares a postinstall script that runs beacon.cjs, which silently collects the hostname, install path and current working directory and POSTs them to an attacker-controlled server at http://185.158.107.175:8787/_ah/dc (srv2022056.hstgr.cloud), swallowing all errors. index.js fires the beacon again on import and exports a no-op Proxy object so that a build which resolved an internal package name to this package keeps working. The package was published with a version ladder up to 99.0.1 to win resolution over private registries, and every version carries the same postinstall hook. The README claims an authorized bug-bounty test, which cannot be verified; the package exfiltrates host data from any machine that installs it.