tecken@0.1.10

Analysis

The package ships no functional code (the tarball contains only package.json at 290 bytes). The preinstall script executes /usr/bin/curl to POST the victim machine's hostname (via $(hostname)) as POST data to the attacker-controlled OAST callback domain d7uvguuc7dusboo3grlgogkiu9qfmcndh[.]oast[.]live. The oast[.]live domain is a public OAST/interactsh callback service used for exfiltration. The package description reads "takeover by dilosec", indicating the package name was hijacked. There is no other functionality — the preinstall hook is the entire payload, performing host reconnaissance and beaconing to the attacker's endpoint.