@capsense/core-ui@99.99.100

Analysis

@capsense/core-ui@99.99.100 is a dependency-confusion placeholder whose package.json wires preinstall, install and postinstall to `node beacon.js <stage>`. beacon.js collects the machine hostname, the OS username, the OS platform, the package id and the lifecycle stage, joins them into one label, and transmits that label to attacker-controlled collection endpoints on every install: a DNS lookup of `<label>.dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro`, an HTTPS GET to `hxxps://<label>.dbf2v9d8dg559apcd93guf6i7uxrn5coo.oast.pro/`, and an HTTPS GET to `hxxps://webhook[.]site/59675304-bec1-4ca0-8409-8d37b65ec116?x=<label>`. The label is stripped to alphanumeric characters and truncated before transmission, and the process exits after two seconds. index.js is an inert empty export, so the beacon runs only from the install lifecycle. The package ships no other code and reads no environment variables or files.