client-cookies-agent@99.9.7

Analysis

The postinstall hook runs index.js which collects the installer's hostname, current working directory, username, and local IP address via os.hostname(), os.userInfo(), and os.networkInterfaces(). This data is serialized as JSON and POSTed to lpzlajzjfkpfeefuzxbv6n5nob7bpuh6e[.]oast[.]fun/receive-data. The C2 endpoint is an interactsh (oast[.]fun) callback domain used for exfiltration. The package has no description, no repository, and no legitimate functionality — its sole purpose is host fingerprinting and beaconing on install.