@capsense/ccx-welcome-page@99.99.100

Analysis

This package is a dependency-confusion probe published under the sentinel version 99.99.100 on the scoped name @capsense/ccx-welcome-page. Its preinstall, install and postinstall hooks all execute `node beacon.js <stage>`, which collects the machine hostname, the local username, the OS platform, the package identifier and the lifecycle stage, joins them into one label, and transmits that label three ways: a DNS lookup of `<label>.dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro`, an HTTPS GET to `hxxps://<label>.dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro/`, and an HTTPS GET to `hxxps://webhook[.]site/59675304-bec1-4ca0-8409-8d37b65ec116?x=<label>`. The script reads no environment variables, files, tokens or credentials, and the package's main module (index.js) is inert. The package presents itself as an authorized responsible-disclosure proof of concept for the unregistered @capsense scope; the effect on any build that resolves the scope from the public registry is that installing it silently reports the build machine's identity to an external callback host.