@atfm/typeface@99.99.99

Analysis

@atfm/typeface@99.99.99 is a version-squat stub (version 99.99.99, ~1KB) whose install and preinstall hooks collect the installer's username, hostname, and working directory, base64-encode them, and exfiltrate them to the attacker-controlled callback host callback[.]m0chan[.]co[.]uk over both HTTP (curl to hxxps://<pkg>.callback[.]m0chan[.]co[.]uk/<base64>) and DNS (nslookup of a base64-encoded package-name subdomain on the same host). The package ships no functional code.