@eforms/forms-api@1.99.0

Analysis

@eforms/forms-api@1.99.0 is a dependency-confusion-shaped package (scoped name, sentinel version 1.99.0, 4KB tarball, empty index.js) whose preinstall hook runs node preinstall.js. That hook collects the installing host's identity — os.hostname(), os.userInfo().username, process.cwd(), process.platform/arch, process.version, a CI-presence flag and uid — and exfiltrates it to two attacker-controlled callback domains, both by DNS and by HTTPS: it builds a label from the hostname plus a random id and resolves <label>.rpkfvtsptfrhcgbe62qg11ywjnpij6ma1cfpke[.]oastify[.]com and <label>.f6mk7lyjsuk3u1t49ypp9q2jbah15rtg[.]oastify[.]com, then issues GET requests to hxxps://<label>.rpkfvtsptfrhcgbe62qg11ywjnpij6ma1cfpke[.]oastify[.]com/ and hxxps://<label>.f6mk7lyjsuk3u1t49ypp9q2jbah15rtg[.]oastify[.]com/ with the collected values in the query string. The DNS path is used so the beacon still fires on networks that block outbound HTTP. The hook suppresses all errors and calls process.exit(0) so the install appears to succeed. The package describes itself as an authorized bug-bounty proof of concept, but its repository field points to example.invalid and no verifiable engagement reference is shipped, so the claim cannot be checked from the package.