@pluxee-connect/account-db-api-client

Version 99.0.0 of this package targets an internal-looking npm scope and ships a postinstall.js that, on every `npm install`, reads os.hostname(), os.userInfo().username, process.version, and the package name and transmits them to the third-party OAST domain `d84t2rmqt3fpphmbii3gf9sdi63c3gkp7.oast.online` over both HTTP GET (port 80) and DNS lookup. The package's main entry (index.js) is a placeholder stub containing only a ConsentsStatus enum with a comment self-describing it as a `PoC stub` mirroring the real package's API. The combination of an inflated 99.0.0 version, a hollow API surface, and an unconditional install-time beacon to an interactsh out-of-band exfiltration host on a scope that resembles an internal Pluxee namespace is a textbook dependency-confusion attack: any build system misresolving the internal name to this public package leaks host identity to the attacker's OAST listener. ## Source: ossf-package-analysis (b7d101dbff5c071f3bab34e97f3d340e0b52caa00e38ef82e630864d44a7dce3) The OpenSSF Package Analysis project identified '@pluxee-connect/account-db-api-client' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.