@galicia-toolkit/tag-manager@999.0.5

Analysis

@galicia-toolkit/tag-manager@999.0.5 ships a postinstall hook ("node postinstall.js || true") that runs on every install and exfiltrates host and build-environment reconnaissance. The script collects hostname, platform, arch, kernel release, Node version, working directory, PID, uptime, CPU count/model, total memory, the current username and home directory, and every non-internal network interface name and address, plus the values of CI/CD environment variables (CI, BUILD_NUMBER, BUILD_ID, JENKINS_URL, JENKINS_HOME, GITHUB_ACTIONS, GITLAB_CI, SYSTEM_TEAMFOUNDATIONCOLLECTIONURI, CODEBUILD_BUILD_ID, npm_config_registry, npm_package_name, NODE_ENV, HOME, COMPUTERNAME, USERDOMAIN, PATH) and the sorted list of all environment variable names present. The JSON payload is POSTed to hxxp://oob[.]s4yhii[.]com:9999/dep-confusion, and three DNS beacons encode the hostname, username and platform/arch as hex-encoded subdomains under h[.]dc[.]oob[.]s4yhii[.]com, u[.]dc[.]oob[.]s4yhii[.]com and m[.]dc[.]oob[.]s4yhii[.]com, giving a fallback channel that works where outbound HTTP is blocked. All errors are swallowed and the hook is suffixed "|| true" so the install completes silently. The package carries a sentinel version (999.0.5) on a scoped name so it wins dependency resolution against an internal package of the same name. IOCs: C2 hxxp://oob[.]s4yhii[.]com:9999/dep-confusion; DNS beacon zones h[.]dc[.]oob[.]s4yhii[.]com, u[.]dc[.]oob[.]s4yhii[.]com, m[.]dc[.]oob[.]s4yhii[.]com (parent oob[.]s4yhii[.]com).