action-slack-message-root@1.0.1

Summary

package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance — os.hostname(), os.platform(), os.arch(), os.release(), os.uptime(), os.cpus(), memory info, and the output of shell commands whoami, id, pwd, and uname -a via child_process — and POSTs the JSON payload over plain HTTP to a hardcoded Burp Suite Collaborator subdomain at http://x86cmb7n60gbagfm4fdws0nw5nbjzanz.oastify.com. The package name resembles legitimate Slack-notification tooling, but the shipped code performs only reconnaissance exfiltration with no advertised functionality. The tarball also declares an unpinned dependency on openmct-heatmap ^1.0.1, consistent with a dependency-confusion / research-probe shape.

Source: amazon-inspector (6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba)