@hzero-front-ui/hzero-ui@99.99.99

Analysis

@hzero-front-ui/hzero-ui@99.99.99 is a version-squat stub (99.99.99, ~500-byte tarball) on a scoped name mimicking the hzero-ui UI library. Its preinstall and install hooks both run on install: they base64-encode the installer's username, hostname, and working directory together with the package name, POST that string to hxxps://<pkgsub>.callback[.]m0chan[.]co[.]uk/<b64> via curl, and also exfiltrate the base64-encoded package name via an nslookup DNS query to <pkgdns>.<pkgsub>.callback[.]m0chan[.]co[.]uk. The package exfiltrates host metadata to the callback domain m0chan[.]co[.]uk on every install.