@galicia-toolkit/spa-build-config@999.0.5

Analysis

@galicia-toolkit/spa-build-config@999.0.5 is a dependency-confusion stub (sentinel version 999.0.5, no repository, no functional build-config code) that executes a payload from its postinstall hook ("node postinstall.js || true"). The hook, in postinstall.js, fingerprints the installing machine — hostname, platform, architecture, OS release, Node version, working directory, PID, uptime, memory, CPU model/count, the current username, home directory, and all non-internal network interfaces — and dumps the full list of process.env keys plus the values of CI/credential-adjacent variables including CI, BUILD_NUMBER, BUILD_ID, JENKINS_URL, JENKINS_HOME, GITHUB_ACTIONS, GITLAB_CI, SYSTEM_TEAMFOUNDATIONCOLLECTIONURI, CODEBUILD_BUILD_ID, npm_config_registry, npm_package_name, NODE_ENV, HOME, COMPUTERNAME, USERDOMAIN and PATH. The collected JSON is POSTed to hxxp://oob[.]s4yhii[.]com:9999/dep-confusion, with a DNS-tunnel fallback that hex-encodes the hostname, username and platform-arch into subdomains of h[.]dc[.]oob[.]s4yhii[.]com, u[.]dc[.]oob[.]s4yhii[.]com and m[.]dc[.]oob[.]s4yhii[.]com via dns.resolve. Any machine that installs this package leaks its build environment and CI metadata to the operator.