@dxcl/customer-js@99.99.99

Analysis

@dxcl/customer-js@99.99.99 is a version-squatting dependency-confusion package with a malicious lifecycle hook. The package ships an empty stub (module.exports = {}) with a fake README, but both its `preinstall` and `install` scripts execute system reconnaissance and exfiltration at install time: they collect the installer's username, hostname, current working directory, and package name, base64-encode the assembled string, and send it as an HTTPS request path to hxxps://<package-name>.callback[.]m0chan[.]co[.]uk/<base64-data>, and also perform a DNS lookup (nslookup) to the same host as a secondary exfiltration channel. The version 99.99.99 is set high to win automatic resolution over legitimate packages in semver ranges.