@coopeuch/common@1.999.999

Analysis

@coopeuch/common is a dependency-confusion package published under a scoped name at version 1.999.999. Its postinstall hook (postinstall.js) runs on install and sends a host fingerprint as JSON over HTTPS to hxxps://collector[.]oob[.]s4yhii[.]com/_npm-poc/beacon, then performs a second, DNS-only beacon by resolving a label built from the package name under db03o8lag74hsugsg2j091t8mfcf437h3[.]oob[.]s4yhii[.]com. The fingerprint contains: package name and version, install directory and current working directory, hostname, username, uid/gid, home directory, platform/architecture/kernel release, Node.js version, CPU model and count, total memory, uptime, configured DNS resolver addresses, non-internal network interface addresses with MAC and CIDR, the presence (names only, never values) of a fixed list of CI markers including CI, GITLAB_CI, CI_PIPELINE_ID, CI_PROJECT_PATH, GITHUB_ACTIONS and RUNNER_NAME, and a fixed allowlist of npm_* lifecycle variables that npm sets itself (npm_command, npm_lifecycle_event, npm_package_name, npm_package_version, npm_config_registry, npm_config_user_agent, npm_config_userconfig, npm_config_globalconfig, npm_config_prefix). It also walks up to eight parent directories to read the consuming project's package.json and record which internal project declared the dependency and with what version range, and reads /proc/1/cgroup to detect containerisation. The script spawns no shell, writes no files, establishes no persistence, and swallows network errors so the install is never interrupted. The shipped index.js is an inert stub that mirrors the exports of the package it shadows so that requiring it does not throw.