karapace-docs@1.1.1

Summary

The npm package's preinstall hook runs index.js at install time, which collects the installer's hostname, username, home directory, DNS server list, and the contents of /etc/passwd and /etc/hosts, then POSTs a JSON payload over HTTPS to a hardcoded Burp Collaborator subdomain n6usddpvkn7jcauar9va0xvleck48uwj.oastify.com. The package name mimics a documentation package for karapace (a Kafka registry project), consistent with a dependency-confusion / typosquat recon payload. Installer host identity and local system file contents leave the machine to an attacker-controlled OAST endpoint on npm install with no user interaction.

Source: amazon-inspector (a0d1e2b10c31f45e3c73ad895a1ccd4188cdedf5ab1a795b420f5aa2693d7686)