carbon-monorepo @20.1.1

Summary

The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets — os.hostname(), full process.env, platform/arch, cwd, package.json, node_modules listing, and the output of shell commands whoami/uname/id/cat /etc/passwd/cat /etc/shadow — and reads ~/.npmrc (which typically contains npm auth tokens) and recent ~/.npm/_logs. The collected data is POSTed over plain HTTP via http.request to the hardcoded host ywy8qnd4a931ga4v74k70b9g67c00qof.oastify.com, a Burp Collaborator (OAST) subdomain. Package metadata masquerades as an esbuild netbsd-x64 build ( "description": "netbsd-x64 build for esbuild" ) but the tarball ships only the recon/exfil script, no build artifacts or library code — the sole install-time effect is running the exfiltration payload.

Source: amazon-inspector (9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713)