@klapp-kyc/routes@99.0.1

Analysis

@klapp-kyc/routes@99.0.1 is a dependency-confusion stub whose preinstall hook runs index.js to harvest hostname, username, dirname and cwd, hex-encode the data, and exfiltrate it via two channels: a DNS resolution to a callback subdomain (d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast[.]live) and an HTTP POST to 172[.]201[.]213[.]59:9090/c. The 'security research' description carries no repository URL or program reference and is a cover for a host-metadata stealer.