hyper-kube-config@1.1.2

Summary

package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS server configuration, current working directory, and the contents of /etc/passwd and /etc/hosts, then POSTs this payload over HTTPS to the hardcoded subdomain x75h3spwmlqq7bzriw6gm6w8azgq4hs6.oastify.com (a Burp Collaborator out-of-band interaction host). Execution is automatic at install time with no consent prompt and no documented purpose. The behavior matches a dependency-confusion reconnaissance beacon that exfiltrates installer host identity and local system files to an attacker-controlled endpoint.

Source: amazon-inspector (4e6e8d8500ee41d92250882b57d98d805b381d2d08eeeac7bae55c3f5e417dff)