@eforms/forms-api@2.99.0

Analysis

@eforms/forms-api@2.99.0 is a dependency-confusion package: a near-empty tarball (4 files, ~4KB, index.js is `module.exports = {}`) published at a sentinel version 2.99.0 for the scoped name @eforms/forms-api, whose preinstall hook (`node preinstall.js`) beacons the installing host's identity to attacker-controlled callback domains. The hook collects os.hostname(), os.userInfo().username, process.cwd(), platform/arch, Node version, a CI-presence flag and uid, then sends them two ways: a DNS lookup of a runtime-built label `depconf-<hostname>-<random>.<callback-domain>` (DNS-tunnel style, survives egress filtering that blocks HTTP) and an HTTPS GET to `hxxps://depconf-<hostname>-<random>.<callback-domain>/?pkg=@eforms/forms-api&ver=2.99.0&host=...&who=...&pwd=...`. Callback domains: rpkfvtsptfrhcgbe62qg11ywjnpij6ma1cfpke[.]oastify[.]com and f6mk7lyjsuk3u1t49ypp9q2jbah15rtg[.]oastify[.]com. The hook reads no files, downloads nothing, spawns nothing, and calls process.exit(0) so the install appears to succeed. The package describes itself as an authorized bug-bounty canary for the @eforms scope; the observed behaviour is host-identity collection and beaconing at install time.