keroeltopkkk@99.99.99

Analysis

keroeltopkkk@99.99.99 is a dependency-confusion stub (synthetic version 99.99.99, no description) whose install, preinstall, postinstall, and prepare lifecycle hooks all execute server.js. That script reads the machine hostname via os.hostname() and sends it to the external webhook endpoint hxxps://eo8f3m3ho26a0nm[.]m[.]pipedream[.]net/keroeltopkkk?h=<hostname> at install time. The package exfiltrates the installer's hostname to a third-party pipedream[.]net endpoint on every install.