@dxcl/transaction-js@99.99.99

Analysis

Dependency-confusion package with malicious preinstall and install lifecycle hooks. On installation, both hooks collect the victim's username, hostname, current working directory, and package name, base64-encode the combined string, and exfiltrate it over HTTPS to the C2 host callback[.]m0chan[.]co[.]uk via HTTP GET with the encoded data in the URL path. A parallel DNS exfiltration channel uses nslookup with a base64-encoded package-name subdomain to the same host. The package index.js is an empty stub (module.exports = {}), providing no real functionality. The version 99.99.99 and description "Internal automation library." are designed to exploit dependency-confusion attacks (installers pulling from the public registry at a higher version than a private/internal package).