@elc-online/up-analytics@99.99.99

Analysis

The package's install and preinstall hooks exfiltrate host metadata at install time. Both hooks base64-encode the current username, hostname, working directory, and package name and send them in the URL path of an HTTP request to callback[.]m0chan[.]co[.]uk, and additionally perform a DNS lookup of a base64-encoded package-name subdomain against the same callback host. The package is a 520-byte stub with no functional code; its only behaviour is this install-time exfiltration beacon.