foodi@99.99.1

Analysis

foodi@99.99.1 runs a curl command in both its preinstall and postinstall hooks that POSTs the installer's username, hostname, and full environment variables (including any credentials/tokens present) to the remote host hxxps://y0zhmssf65c8er7btoglvt9bg2mtakc81[.]oastify[.]com, using -k to skip TLS verification and suppressing errors with `|| true`. The package is a 447-byte stub published at version 99.99.1 with no functional code, matching a dependency-confusion squat shape. The environment dump exfiltrates secrets such as npm/GitHub/cloud tokens to the attacker-controlled callback host.