@access-risk/browser-remedy-react@99.0.0

Analysis

@access-risk/browser-remedy-react@99.0.0 is a 1.8KB dependency-confusion stub (3 files) that runs postinstall.js on install. The script collects system metadata (os.hostname(), os.userInfo().username, install path, and a directory tree to depth 2) and exfiltrates via two channels: an HTTPS POST of the base64-encoded JSON payload to the callback domain xjaipnfhcpawuhzlgzkzx9k5rrgo6df89.oast[.]fun, and a DNS fallback that encodes hostname and username as a hex subdomain label resolved against the same oast[.]fun domain. The exfiltration was observed carrying a JSON body of the form {"h":...,"u":"<user>","p":"...","tree":[...]}.