autobahn-electron-probe@99.99.1

Analysis

autobahn-electron-probe@99.99.1 is a dependency-confusion stub (high version 99.99.1 on a name resembling an internal package) shipping a 618-byte tarball. Both its preinstall and postinstall hooks execute curl against hxxp://da9nu7avbsgtvoua4om0746ibn3suot7h[.]cyowl[.]com/autobahn-electron-probe/ with query parameters exfiltrating the installer's username ($(whoami)), hostname ($(hostname)), current working directory ($PWD), and a timestamp, discarding the response to /dev/null. Installing the package beacons this host metadata to the remote host on every install.