aedes_clusters @1.0.1

Summary

The package's package.json declares a preinstall: node index.js hook that fires automatically on npm install . index.js collects host reconnaissance data (os.hostname(), os.userInfo().username, home directory, DNS server configuration) and reads local system files including /etc/passwd and /etc/hosts, then HTTPS-POSTs the collected data to the hardcoded Burp Collaborator subdomain b5hv16nakzo45px5ga4ukkum8de52vqk.oastify.com. oastify.com is Burp Suite's out-of-band interaction service, commonly used as an attacker-controlled exfiltration sink. There is no legitimate functionality; the package's sole install-time behavior is host recon and data exfiltration.

Source: amazon-inspector (6f0750fab7cca2996255b57d6fa98107b2d6b710fc8ab62f30345158ff3b7560)