auth0.net@39.1.0

On `npm install`, package.json's `preinstall` (and `preupdate`/`test`) hook runs `nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun`. The destination `oast.fun` is the Project Discovery interactsh out-of-band callback service used to confirm code execution on victim hosts via a unique DNS subdomain. Firing automatically on install leaks the installer's existence and the corporate DNS resolver's egress IP to an attacker-controlled nameserver, with the unique subdomain serving as a per-victim correlation token. The package itself is hollow — `index.js` is empty, `description` is the placeholder 'Internal package', and `author` is 'Team' — and the package name `auth0.net` impersonates the Auth0 brand, consistent with a dependency-confusion attempt against an internal Auth0/.NET package name. The DNS beacon is the recon stage of that attack: the operator learns which organizations have misconfigured their registry resolution to pull this public package instead of an internal one, enabling targeted follow-on compromise.