ap3-components-ui@9.999.0

Analysis

ap3-components-ui@9.999.0 is a combosquat package that runs a host-reconnaissance and data-exfiltration payload on preinstall. The preinstall hook executes a shell command that collects the hostname, current working directory, username, and external IP address (via ifconfig[.]me), hex-encodes the collected data, and exfiltrates it via DNS lookups to the OAST callback domain d987f5ra3q1r1j7ahol0yzuwujwe76i55[.]oast[.]fun. The package contains only two files (index.js and package.json) totaling 564 bytes, has no repository, and its declared main.js does not exist.