@dxcl/account-js@99.99.99

Analysis

The package @dxcl/account-js at version 99.99.99 is a dependency-confusion stub with no functional code (index.js exports an empty object). Its preinstall and install hooks collect system identity (whoami, hostname, current working directory) and exfiltrate it via HTTP GET and DNS query to callback[.]m0chan[.]co[.]uk. The script builds two exfiltration channels: an HTTPS request to hxxps://<base64-package-name>.callback[.]m0chan[.]co[.]uk/<base64-of-whoami:hostname:pwd:package_name>, and a DNS nslookup to <base64-package-name>.<slug-package-name>.callback[.]m0chan[.]co[.]uk. The C2 host is callback[.]m0chan[.]co[.]uk.