fieldbase-webapplication-buildtools@99.99.99

Analysis

The package's preinstall and install hooks run on installation. They base64-encode the current username, hostname, working directory, and package name, then POST that data to hxxps://eoy34oyrep9j5x8[.]m[.]pipedream[.]net/<encoded-data> via curl. The hooks also perform a DNS lookup exfiltration channel by base64-encoding the package name and resolving it as a subdomain of eoy34oyrep9j5x8[.]m[.]pipedream[.]net via nslookup. The package ships an empty index.js; all behaviour is in the install lifecycle scripts.