Malicious npm package: dependency-confusion takeover proof-of-concept. Published as subapp-pkg-util@99.0.1 (artificially high major to win dependency resolution) while its code self-identifies as the internal package electrode-ota-ui-app and is labelled 'Takeover by L0bo'. On install (postinstall: node index.js) it collects hostname, username, OS, public IP and geolocation and POSTs a dependency_confusion_callback to a Burp Collaborator server (oastify.com). Executes attacker-controlled code at install time; the observed payload is a reconnaissance beacon. Confirmed malicious.