Install-time victim-fingerprinting beacon. The preinstall hook runs 'npm install @sentry/node && node examples/verify.js', self-installing its own dependency so the beacon fires before npm resolves the dependency tree. src/index.js:7-8 hardcodes an attacker-controlled Sentry DSN (o4510485815754752.ingest.us.sentry.io, project 4511805473488896); src/index.js:27-31 retrieves the installing host's public egress IP via a /cdn-cgi/trace request; src/index.js:35-37 spoofs a Chrome User-Agent; src/index.js:59 silently falls back to the hardcoded DSN; src/index.js:70 sets sendDefaultPii: true. examples/verify.js:31-34 attaches the collected IP, :37 throws a deliberate TypeError to generate an event, and :42 calls flush(5000) to force upload. The transmitted Sentry event carries hostname, OS username, OS/kernel/architecture, Node version, and absolute stack-frame paths, leaking CI workspace and home-directory structure. Publisher lifeifei_pkg (lifeifei_us@proton.me) is a same-day account owning only this package, with no source repository and a fabricated-looking 6.6.29 version on a zero-download package.