@salem_jalal/osc-components@1981.17.7

Analysis

Dependency-confusion package impersonating the Hilton Design System internal package (@dx-ui/osc-components). On npm install, the postinstall hook (install.js) collects system metadata (hostname, platform, CPU architecture, username, current working directory, Node.js version, npm registry URL, DNS server addresses) and sends them via HTTP GET to dm-tech.ly:8001/poc-osc/callback. When the module is required in a browser context, the main entry (index.js) exfiltrates the browser's current URL, all cookies (document.cookie), all localStorage key-value pairs, and the user-agent string to dm-tech.ly:8001/poc-osc/exfil via fetch with credentials:include. IOCs: domain dm-tech.ly, port 8001, paths /poc-osc/callback and /poc-osc/exfil.