Malicious dependency-confusion package. Published at version 999.9.16 to override an internal package of the same name via npm's highest-version resolution. A silent preinstall hook (node index.js) auto-executes on install, collects a host reconnaissance fingerprint (hostname, username, home/cwd, public IP and subnet, and probes for GitHub/npm usernames, git email domain, npm registry, NODE_ENV, CI identifiers and AWS region) and exfiltrates it as hex-encoded chunked DNS queries (DNS tunneling) to the OAST/Interactsh collaborator da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun. Self-declares as authorized security research but is an unsolicited package that runs and exfiltrates without consumer consent. Same author and beacon host as @temptation.js/utils 999.9.16.