dependencyfsdsfdsfg @99.9.0

Summary

package.json declares postinstall: node index.js , causing index.js to run automatically on npm install . The script collects the installer's username (via whoami ), os.hostname() , process.cwd() , and non-internal IPv4 addresses from os.networkInterfaces() , then sends them as query-string parameters via HTTPS GET to the hardcoded endpoint https://xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com . The *.oastify.com host is a Burp Collaborator out-of-band interaction domain. Package metadata is consistent with a dependency-confusion probe: gibberish name dependencyfsdsfdsfg , version 99.9.0 , empty author/description/keywords.

Source: amazon-inspector (c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab)