@clearpool/utils@9.9.9

package.json declares `preinstall` and `install` lifecycle hooks that collect installer-identifying data (`whoami`, `hostname`, `pwd`, `$npm_package_name`), base64-encode it, and transmit it to attacker-controlled infrastructure at `*.callback.m0chan.co.uk` via two independent channels: an HTTPS GET with the encoded payload in the URL path, and a DNS lookup embedding the encoded package name as a subdomain label (DNS-tunnel exfiltration to bypass HTTP egress filters). The package uses the `@clearpool` scope with version `99.99.99` and empty author metadata — classic dependency-confusion markers aimed at hijacking resolution of an internal package name within organizations that use this scope privately. Any developer or CI system running `npm install` with this package resolved will leak user, host, working directory, and the requested internal package name to the attacker, providing reconnaissance for follow-on targeted attacks. ## Source: ossf-package-analysis (402b776bfcc2da45256da8475f7acaa61c2c1f9679e09f0409523062ffe3d823) The OpenSSF Package Analysis project identified '@clearpool/utils' @ 99.99.99 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.