@digiptf/common@99.99.99

Analysis

@digiptf/common@99.99.99 is a dependency-confusion package with no functional code (index.js exports an empty object). Both the preinstall and install lifecycle hooks collect the installer's username, hostname, current working directory, and the package name, encode them as base64, and exfiltrate them via HTTP GET to hxxps://digiptf-common[.]callback[.]m0chan[.]co[.]uk/<base64-payload>. The hooks also perform a DNS lookup (nslookup) to a base64-encoded variant of the package name at the same domain (callback[.]m0chan[.]co[.]uk) as a secondary exfiltration channel.