@newline53/newline-ts-sdk

On `npm install`, the postinstall hook (`node install.js`) collects `os.hostname()` and `os.userInfo().username` along with the package name, encodes them as a DNS subdomain of `mjcfux88wjjahplabxdauc6bl.canarytokens.com`, and beacons out via DNS resolution (`dns.lookup`/`dns.resolve`) and HTTP requests (shelled `curl`/`wget` to `http://<host-username-pkg>.mjcfux88wjjahplabxdauc6bl.canarytokens.com`). The package has no real functionality — `index.js` is `module.exports = {}` — and `package.json` carries placeholder author metadata (a 32-char hex string with no homepage or repository). The structure (empty main, recon-only postinstall, canarytoken endpoint) is the canonical dependency-confusion probe: an attacker publishes a public npm package matching an internal scope name to detect whether private builds inside a target organization resolve to and install the public name. The exfiltrated hostname/username identifies the victim environment to the attacker. ## Source: ossf-package-analysis (5410fe1569b6b68356a714bec6729f19f05c94faa3ee858c58df8a35345f5eca) The OpenSSF Package Analysis project identified '@newline53/newline-ts-sdk' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.