@atfm/atfm-material-ui@99.99.99

Analysis

The package is a dependency-confusion stub (scoped name, version 99.99.99, no real code) whose preinstall and install hooks exfiltrate installer host metadata. On install, the hook base64-encodes the current username, hostname, and working directory together with the package name and sends it via HTTP GET to hxxps://<package-subdomain>.callback[.]m0chan[.]co[.]uk/<base64-payload>, and additionally performs a DNS lookup of the base64-encoded package name against <package-subdomain>.callback[.]m0chan[.]co[.]uk. The callback domain m0chan[.]co[.]uk receives the installer's username, hostname, and working directory over both HTTP and DNS channels.