@shell-cabinet/routes@99.9.5

Analysis

A dependency-confusion stub in the @shell-cabinet scope (version 99.9.5, 589-byte tarball, two files, no readme or useful exports). Its postinstall payload runs in two stages: scripts/scream3gg.js exfiltrates hex-encoded os.hostname, os.homedir, and os.userInfo().username via fetch to nmd25sur8sjp60lm75dp67e2gtmkaayz[.]oastify[.]com; then curl pipes /etc/passwd via --data to a second oastify[.]com subdomain keyed by hostname.