@offa-uwk/offa-uwk @999.0.6

Summary

On npm install , the package's postinstall script ( node index.js ) collects host identifiers ( os.hostname() , os.userInfo().username , process.cwd() ) and POSTs them via HTTPS to a hardcoded webhook.site collector at https://webhook.site/e6b10849-38dc-4280-a8e3-72ab39cfaf65 . Immediately after the beacon, the script executes shutdown -h now with a fallback of systemctl poweroff , forcibly powering off the installing host. A preinstall step also writes a marker file to the absolute path /home/OFFA/flag , outside the package directory. Package metadata (name @offa-uwk/offa-uwk , version 999.0.6 ) is consistent with a proof-of-concept malicious artifact.

Source: amazon-inspector (115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2)