@hzero-front-ui/cfg@99.99.99

Analysis

The package's preinstall and install hooks run on installation: they base64-encode the current username, hostname, and working directory and send them to hxxps://<package-name>.callback[.]m0chan[.]co[.]uk/<base64-payload> via an HTTP GET, and also exfiltrate the package name via a DNS nslookup query to <base64-package-name>.<package-name>.callback[.]m0chan[.]co[.]uk. This is a covert host-metadata beacon that reports the victim's identity and environment to the attacker-controlled domain m0chan[.]co[.]uk on every install.