dpg-media-7ehemel @999.9.15

Summary

npm package dpg-media-7ehemel@999.9.15 executes node index.js from a preinstall lifecycle script that harvests installer identity and environment context and beacons it to the hardcoded host da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun . The script collects os.hostname() , username/home/cwd/INIT_CWD, local and public IP addresses (via https.get to api.ipify.org / icanhazip.com / ifconfig.me), resolver IPs, and CI metadata (repo, actor, run id, workflow, AWS region), and spawns gh api user --jq.login , npm whoami , and git config user.email to attribute the environment to a specific developer/org, plus reads parent project package.json fields. The payload is serialized as JSON, hex-encoded, chunked to 60-character DNS labels, and exfiltrated both via dns.resolve subdomain queries ( ${i}-${c}.u-${uuid}.<callback> ) and via HTTP/HTTPS POST to /poc/${uuid} on the same callback host. The version string 999.9.15 and the developer-identity harvest are characteristic of a dependency-confusion beacon targeting a private-scope name. Any self-description as authorized research is contradicted by the DNS-tunneling exfiltration channel and the absence of installer consent.

Source: amazon-inspector (4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594)