@listings/energy-labels@99.0.1

Analysis

Dependency-confusion stub: @listings/energy-labels@99.0.1. A preinstall hook runs index.js, which exfiltrates hostname/user/cwd via a DNS subdomain to d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg[.]oast[.]live and via HTTP POST to 172[.]201[.]213[.]59:9090/c. All errors are silently swallowed and '|| true' masks failures. oast[.]live is an OOB interaction-server domain used here as a C2 exfil channel. Sentinel-version dependency-confusion malware with a C2 beacon.