@dxcl/indicators-js@99.99.99

Analysis

@dxcl/indicators-js@99.99.99 is a 517-byte stub package with preinstall and install lifecycle hooks that collect the installer's system fingerprint — username, hostname, current working directory, and package name — base64-encode the result, and exfiltrate it to callback[.]m0chan[.]co[.]uk via both HTTP GET (curl) and DNS lookup (nslookup). The package's main file is an empty stub (module.exports = {}), so the package has no legitimate functionality. The version 99.99.99 is a sentinel/version-squat value. IOC: *.callback[.]m0chan[.]co[.]uk (HTTP and DNS exfiltration C2).