twig.extras@99.99.9

Analysis

twig.extras@99.99.9 is a dependency-confusion package that exfiltrates environment data via DNS. On npm install, the postinstall hook runs index.js which collects the OS username, hostname, and current working directory. This data is encoded into a DNS lookup subdomain (twig.extras.<username>.<hostname>.<cwd>.<timestamp>.oob[.]sl4x0[.]xyz) and resolved against the attacker's DNS server at oob[.]sl4x0[.]xyz, exfiltrating the host fingerprint. The package uses module.constructor._load to bypass standard require hooks. The publisher email domain (sl4x0[.]xyz) matches the C2 domain.