consumerweb@2200.4.2

Analysis

consumerweb@2200.4.2 is a dependency-confusion/trojanized package that exfiltrates host fingerprint data to an oastify callback domain. On install, its preinstall and postinstall hooks both run index.js, which collects the hostname, home directory path, username, DNS resolver addresses, current working directory, and the package.json contents. This data is exfiltrated via two channels: (1) a DNS lookup to a subdomain of bvfmpadujgjgmbtzeibi1n3vi1psox11k[.]oast[.]fun encoded with the hostname and a hash of the collected data; (2) a HTTPS POST of the full data to hxxps://bvfmpadujgjgmbtzeibi1n3vi1psox11k[.]oast[.]fun/. The package has no repository, no README, and uses an unrealistic version number (2200.4.2) consistent with dependency-confusion attacks.