@azure-growth/signup-ux-components@1.2.3

Analysis

This package runs a DNS exfiltration beacon at install time. Its package.json declares "preinstall": "node index.js", and index.js reads the local OS username (os.userInfo().username) and machine hostname (os.hostname()), strips non-alphanumeric characters, and folds both values into a DNS name of the form msrc-poc.<username>.<hostname>.dbg6vplohjpkmtolbi6g18ekofkxjzm4s[.]oast[.]fun, which it resolves with dns.lookup() inside a try/catch that silently swallows errors. No HTTP request is made — the installer's host identity is carried out in the DNS query itself to an OAST-style callback domain, so the beacon is invisible to HTTP traffic inspection. The "msrc-poc." label is a lure suggesting a Microsoft security-response proof of concept. The tarball also ships a 4.49MB copy of the signup[.]azure[.]com production Angular bundle as evidence/signup.azure.com_main-X2UUFOOI.js, which is never required or executed and serves only as padding and pretext. No npm, GitHub or cloud token files are read by the install hook.