@uol-afiliados/affiliated-config-lib@102.0.0

Summary

@uol-afiliados/affiliated-config-lib@102.0.0 declares a preinstall hook (node index.js) that shells out via require('child_process').exec to run curl against a subdomain of hqbv58hgt1sjk7vf7ru4o0mwzn5etahz.oastify.com (Burp Collaborator out-of-band interaction infrastructure). The subdomain is constructed with shell command substitution $(hostname).$(whoami), so the installer's host name and current user name are embedded in the DNS/HTTP request and sent to the attacker-controlled collector automatically on npm install. The package ships no legitimate functionality — the sole install-time effect is host/user identifier exfiltration. The scoped name @uol-afiliados/* mimics an internal organization namespace, consistent with dependency-confusion reconnaissance.

Source: amazon-inspector (2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d)