keroeltop@99.99.99

Analysis

Dependency-confusion stub published at version 99.99.99 with an empty description. Every lifecycle hook (preinstall, install, postinstall, prepare, etc.) executes index.js, which reads the machine hostname and sends it to the remote endpoint hxxps://eo8f3m3ho26a0nm[.]m[.]pipedream[.]net/keroeltop?h=<hostname> at install time. The package exfiltrates the hostname of any machine that installs it to this third-party endpoint.