mw-filesystem-events-nodream-es6@0.0.32

Analysis

mw-filesystem-events-nodream-es6 disguises itself as a native filesystem-events library but contains zero real functionality. All three lifecycle hooks (preinstall, install, postinstall) run node index.js, which deploys three parallel exfiltration channels to etbhnvpjylr3xogjwsl2us7g177yvtji[.]oastify[.]com: (1) curl --data '@/etc/passwd' via a subdomain-tagged hostname, (2) an nslookup DNS exfil with base64-encoded package|hostname|user|platform, and (3) an HTTPS POST of a full system fingerprint (hostname, user, platform, release, arch, cwd, pid, node version, home, path, shell) plus /etc/passwd contents. The HTTPS POST with the full JSON payload and multiple DNS queries to the host were observed. The /etc/passwd theft exceeds a host-metadata-only beacon.