@nstrlabs/sdk@99.0.1

Analysis

@nstrlabs/sdk@99.0.1 is a dependency-confusion stub whose preinstall hook runs index.js to capture hostname, username and cwd and exfiltrate via two channels: hex-encoded data sent as a subdomain to the callback service d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast[.]live, and an HTTP POST of the JSON payload to raw IP 172[.]201[.]213[.]59:9090/c. Errors are silently swallowed (|| true plus empty handlers), and the 'security research' description (no repository URL or verification) masks the host-metadata stealer.