emulative @1.0.1

Summary

On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DNS server configuration, and the contents of /etc/passwd and /etc/hosts, then POSTs the aggregated data over HTTPS to the hardcoded host 0645dqp8k07wcnunrmvn0avyepkg87ww.oastify.com (a Burp Collaborator subdomain). The destination is attacker-controlled and unrelated to any documented package function; the collection and exfiltration fire automatically on default install without any user action.

Source: amazon-inspector (6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca)