@azure-growth/signup-ux-components@2.9.9

Analysis

The package is a hollow shell whose only executed code is its preinstall hook, which performs a DNS-based victim-identity callback at install time. package.json declares "preinstall": "node index.js"; index.js reads the local username (os.userInfo().username) and hostname (os.hostname()), strips non-alphanumeric characters, embeds both into the subdomain of a collaborator host — msrc-poc.<username>.<hostname>.dbg6vplohjpkmtolbi6g18ekofkxjzm4s[.]oast[.]fun — and resolves it with dns.lookup(), discarding the result. Because the host identity travels entirely in a DNS query, the install-time beacon uses no HTTP request at all. The tarball ships no real library code: besides index.js and a minimal package.json it only contains a third-party signup browser bundle under evidence/ and evidence/bundle-grep-output.txt naming @azure-growth/azure-growth-signup-sdk and @azure-growth/signup-ux-components, used to make the package look like part of an Azure signup SDK. The "msrc-poc" prefix labels the callback as a proof-of-concept while the actual behaviour is an attacker-controlled DNS callback that leaks the installer's username and hostname. IOC: DNS callback domain dbg6vplohjpkmtolbi6g18ekofkxjzm4s[.]oast[.]fun (subdomain labels oast[.]fun), invoked from index.js via the preinstall lifecycle hook.