@dxcl/user-js@99.99.99

Analysis

Version-squatting supply-chain attack. Package @dxcl/user-js@99.99.99 is a tiny stub (983 bytes) whose preinstall and install hooks both collect the installer's username, hostname, current working directory, and the package name, base64-encode that data, and exfiltrate it via curl to hxxps://{package-name-encoded}[.]callback[.]m0chan[.]co[.]uk/{base64-payload}. The hooks also perform DNS-based exfiltration of the package name via nslookup to the same callback[.]m0chan[.]co[.]uk domain.