omni-channel-configurator-wireline-frontend@9999.0.0

Summary

The package declares scripts.preinstall=node preinstall.js, so npm install unconditionally executes preinstall.js. That script collects installer identifiers (os.hostname(), os.userInfo().username, cwd, install path, process.platform, node version, npm user-agent, package name/version) and transmits them over two hardcoded channels to non-first-party destinations: an HTTP(S) POST to the Interactsh OAST callback subdomain dae7n4pijsh1ahi9684gu8get3kaiefc9.oast.online and to the bare IP 5.189.159.252, plus a DNS-tunnel channel that hex-encodes token, package name, hostname, and username as subdomain labels under the same OAST host and triggers dns.lookup. The package ships no library functionality matching its name; the preinstall beacon is the entire behavior. A self-labelled 'authorized security research / dependency-confusion PoC' string in the payload is author-controlled and does not change the observed behavior, which is a dependency-confusion exfiltration beacon fired at install time against any machine that resolves this name.

Source: amazon-inspector (21d5b16b4e350d836e67410e299a1862f704c92e7bb3f26cedae46ffc7d90273)