@dxcl/http-common-js@99.99.99

Analysis

Package @dxcl/http-common-js@99.99.99 contains identical malicious preinstall and install lifecycle hooks. On installation, both hooks collect the installer's username, hostname, current working directory, and the package name itself — all base64-encoded and exfiltrated via HTTPS GET to callback[.]m0chan[.]co[.]uk using curl. A secondary DNS lookup (nslookup) against the same domain is also performed, serving as a DNS-based beacon/exfiltration channel. The package's index.js is an empty stub (module.exports = {}), and its description is a generic decoy ('Internal automation library.'). The package has no legitimate functionality — its sole purpose is host reconnaissance and outbound beaconing.