@hzero-front-ui/c7n-ui@99.99.99

Analysis

The package is a dependency-confusion stub (scoped name, version 99.99.99, ~500-byte tarball with no functional code). Its preinstall and install hooks base64-encode the installer's username, hostname, working directory and package name, then exfiltrate that metadata to the attacker-controlled callback domain callback[.]m0chan[.]co[.]uk via an HTTP GET to hxxps://<pkgsub>.callback[.]m0chan[.]co[.]uk/<base64> and a DNS lookup of a base64-encoded subdomain of the same host. Installing the package leaks host/user/cwd information to the remote callback server.