@whatnot-web/www-legacy@99.1.2

Analysis

@whatnot-web/www-legacy@99.1.2 is a dependency-confusion/combosquat publish impersonating an internal npm namespace, shipping a 1107-byte tarball with a stub index.js (module.exports={}) and a malicious postinstall.js. The postinstall script collects hostname, username, cwd, and a recursive directory tree, then exfiltrates them via HTTPS POST to wybqtvzmfhssbvhokfgb61yfn41sqvc9c[.]oast[.]fun. A DNS fallback hex-encodes hostname and username and performs a lookup against the same domain as an egress bypass.