@dxcl/fund-js@99.99.99

Analysis

@dxcl/fund-js@99.99.99 is a dependency-confusion package that deploys host reconnaissance and data exfiltration via lifecycle hooks. The preinstall and install scripts collect the installer's username, hostname, current working directory, and package name, base64-encode the combined data, and exfiltrate it to the attacker-controlled domain callback[.]m0chan[.]co[.]uk via both an HTTP POST (curl) and a DNS query (nslookup). The actual JavaScript code shipped with the package is an empty stub (module.exports = {}); the entire malicious behaviour runs during installation.