cisco-github-simple@1.0.1

Summary

The package declares a preinstall lifecycle hook (node index.js) that runs automatically on npm install. index.js collects host reconnaissance from the installer — os.hostname(), os.userInfo().username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, together with the package.json — assembles them into a JSON tracking payload, and POSTs the payload over HTTPS to the Burp Collaborator subdomain prk15yh0sbkd1305h200c2wv5mbhz7nw.oastify.com. The package name impersonates Cisco's GitHub namespace, consistent with a dependency-confusion recon beacon targeting internal Cisco builds. There is no legitimate purpose served by the code; installing or building against this package leaks sensitive host and account information to an attacker-controlled out-of-band domain.

Source: amazon-inspector (2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205)