@cloudplatform-single-spa/ml-foundation-models@99.99.99

Analysis

Dependency-confusion stub impersonating the @cloudplatform-single-spa enterprise namespace at version 99.99.99 to outrank the legitimate package. The tiny ~7.9KB bundle includes a postinstall hook (scripts/postinstall.js) that contacts the command-and-control domain oob[.]moika[.]tech on install. Published by a repeat malware author who has shipped other packages in the same namespace; later taken down.