riskunifiedgatewayserv @28.0.0

Summary

Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home directory, and configured DNS servers via os.hostname(), os.platform(), os.arch(), os.homedir(), and dns.getServers(), then POSTs the collected data to a hardcoded Burp Collaborator subdomain lh68zt2urttjod19rzsz0dssxj3brff4.oastify.com at path /hit. Execution is automatic on default npm install; the destination is attacker-controlled and unrelated to any legitimate package function.

Source: amazon-inspector (0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b)