@coze-common/chat-area@99.1.1

Analysis

@coze-common/chat-area@99.1.1 is a dependency-confusion malware. Version-squatted at 99.1.1 (3 files, 1.8KB, 1 version) pretending to be a @coze-platform utility. Publisher [account] Postinstall.js collects hostname, username, CWD, and filesystem directory tree (depth 2, 15 entries), then exfiltrates via HTTPS POST (base64) to wybqtvzmfhssbvhokfgbvgaalpfg1vneq[.]oast[.]fun — a known OOB-style exfil endpoint. Also uses DNS lookup with hex-encoded hostname+username as a fallback side-channel. No token-theft markers, but the install-triggered beacon alone is malicious.