mermaid-v11@9999.0.0

Analysis

mermaid-v11 combosquats the real mermaid diagramming library. The package contains only a package.json with a preinstall hook that collects hostname and username via os.hostname() and os.userInfo().username, then exfiltrates them to d8ks495t5p5ut2enft8041g7fusnfsy5e[.]oast[.]site via both an HTTPS GET and a DNS lookup (using the subdomain as a side channel). Version 9999.0.0 and the absence of any real library code confirm a combosquat reconnaissance beacon.