@myorder-frontend-commons/analytics@101.0.0

Analysis

@myorder-frontend-commons/analytics@101.0.0 is a dependency-confusion package: it uses a scoped name and a sentinel version (101.0.0) with a ~3.8 KB tarball whose preinstall, install and postinstall hooks all execute `node poc.js`. That script fingerprints the installing host — hostname, OS username, current working directory, platform/arch/release, Node version, the triggering npm lifecycle event, and the names of any CI environment variables present (CI, JENKINS_URL, GITLAB_CI, GITHUB_ACTIONS, BUILDKITE, TEAMCITY_VERSION, BAMBOO_BUILDKEY, DRONE, CIRCLECI) — and sends the data as an HTTP GET to /beacon/<token> on an external collector at db69ak0hu4nqhtf9omnguspxhjk8kuide[.]oast[.]fun, with a fallback host of 80-190-83-27[.]nip[.]io, using the User-Agent "allegro-dc-poc/1.0 (authorized security test)". The beacon fires unconditionally on install. index.js is an inert stub returning empty arrays; the package reads no credential files or environment values, writes nothing and registers no persistence. The package describes itself as an authorized security-research proof of concept. IOCs: hxxp://db69ak0hu4nqhtf9omnguspxhjk8kuide[.]oast[.]fun/beacon/594c7180-55fb-48e0-9aa5-32c1278fed3e and hxxp://80-190-83-27[.]nip[.]io/beacon/594c7180-55fb-48e0-9aa5-32c1278fed3e.