Malicious code in chameleon-src (npm)

The npm package chameleon-src was found to contain malicious code embedded in its preinstall lifecycle script (examples/verify.js). During installation, the script executed code that collected sensitive information about the installer without consent or disclosure.\n\nThe malicious behavior included: invoking a hardcoded Sentry DSN initialization with sendDefaultPii enabled, fetching the installer's public IP address from Cloudflare's trace endpoint, attaching the IP and hostname as user metadata to a Sentry event, deliberately triggering an exception to force event capture, and flushing the data to ensure upload before process exit. This telemetry exfiltration occurred on every npm install of the package.\n\nThe package's name and description did not disclose any telemetry collection, making the behavior deceptive. The malicious code was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.\n\nUsers who installed this package had their public IP addresses and hostnames transmitted to the attacker's Sentry project (o4510485815754752.ingest.us.sentry.io, project 4511805473488896) without any opt-in mechanism or configuration option to prevent it.