@klapp-login-platform/routes@99.0.2

Analysis

@klapp-login-platform/routes@99.0.2 is an 808-byte dependency-confusion stub whose preinstall hook (node index.js || true) fires index.js, a dual-channel host-metadata beacon. It collects hostname, username, __dirname and cwd, hex-encodes them, and exfiltrates via a DNS resolution to the callback domain d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast[.]live and an HTTP POST of the same JSON to 172[.]201[.]213[.]59:9090/c. The 'security research' description has no repository URL or program reference and masks the dual-exfil stealer.