@atfm/utils@99.99.99

Analysis

The package is a tiny stub (no functional code) whose preinstall and install hooks both run on installation: they collect the installer's username, hostname, current working directory, and package name, base64-encode them, and transmit them to the remote host callback[.]m0chan[.]co[.]uk via an HTTP GET to hxxps://<package-name>.callback[.]m0chan[.]co[.]uk/<encoded-data>, and additionally leak the data through a DNS query (nslookup) to the same domain. This exfiltrates host metadata to an external callback server on every install.