MAL-2024-7418 is not malicious but just sending a ping to a host

[Shivang0]

MAL-2024-7418 is not malicious but just sending a ping to a host

[calebbrown]

While not strictly malicious, this package does fall into the what is acceptable for this repository (see changes proposed in #381).

• The behaviour exfiltrates the hostname to a domain used by the interactsh tool. Hostname is sensitive enough to launch further targeted attacks.
• The name and description of the package do not indicate this behavior, and in-fact masquerade as a react related package - likely indicating a dependency confusion attempt.
• The versions of react-devtools-fusebox in question have been removed from NPM.
• Finally, the original version of the package v2.0.1 (not included in the advisory) exfiltrated further identifying data (including username, and homedir).