@hzero-front-ui/themes@99.99.99

Analysis

The package's preinstall and install hooks collect the installer's username, hostname, and working directory, base64-encode them, and exfiltrate them to the callback domain callback[.]m0chan[.]co[.]uk via an HTTP GET to hxxps://<package-name>.callback[.]m0chan[.]co[.]uk/<encoded-data> and a DNS lookup (nslookup) of <encoded-package-name>.<package-name>.callback[.]m0chan[.]co[.]uk. The exfiltration runs automatically on install.