twig.extras@99.99.10

Analysis

The package twig.extras@99.99.10 is a dependency-confusion stub that performs data exfiltration via DNS. On npm install, its postinstall hook runs index.js, which uses module.constructor._load to bypass the standard require chain, loads the os and dns modules, collects the installer's username (os.userInfo().username), hostname (os.hostname()), and current working directory (process.cwd()), then encodes them into a DNS lookup to the attacker-controlled domain oob[.]sl4x0[.]xyz. The query is constructed as twigextras.<username>.<hostname>.<cwd>.<timestamp>.oob[.]sl4x0[.]xyz, enabling the attacker to receive reconnaissance data from every system that installs the package. The environment reconnaissance (username, hostname, working directory) is a precursor to further targeted compromise.