@remitee-money-transfer/rmt-base

Package ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On `npm install`, the script reads /etc/passwd and /root/.ssh/id_rsa, fetches the host's public IP via ifconfig.me, and POSTs all three values to https://astralishmx.requestcatcher.com/BONK2 using `curl -k` (TLS verification disabled). The package is published under a scope impersonating Remitee (`@remitee-money-transfer/rmt-base`) at an inflated version (99.99.102) consistent with a dependency-confusion attack against a private internal package; the declared `main: index.js` does not exist in the tarball. The author handle (`astralis`) matches the exfiltration hostname, and requestcatcher.com is a free request-capture service commonly abused as a low-effort exfiltration sink. The combined fingerprint — install-time read of classic installer secrets, hardcoded attacker C2, namespace impersonation, dependency-confusion versioning, and absence of any legitimate code — leaves no benign interpretation.