@usaa-grp-personal-profile/personal-profile-common@999.0.0

Package published to public npm under an internal-looking scope (@usaa-grp-personal-profile) at version 999.0.0, a shape consistent with dependency-confusion targeting an organization's internal registry. package.json declares preinstall and postinstall hooks that execute beacon.js on npm install. beacon.js reads os.hostname(), os.userInfo().username, and process.cwd(), hex-encodes them into DNS labels, and issues dns.lookup queries against a subdomain of oastify.com (Burp Collaborator out-of-band service), transmitting installer host, user, and working-directory identifiers to a third-party OAST endpoint on every install. The exfiltration fires automatically without user invocation and reaches an attacker-controllable Collaborator subdomain regardless of any research/PoC framing in the package metadata.