starship-timeline@1.0.2

Summary

starship-timeline@1.0.1 ships no real functionality. Its package.json declares a preinstall hook ("preinstall": "node index.js") that runs automatically on npm install. index.js collects hostname, username, home directory, DNS servers, package metadata, and the contents of /etc/passwd and /etc/hosts, then POSTs the bundle over HTTPS to a hardcoded Burp Collaborator (*.oastify.com) subdomain (5tziqozihbss8jg955ez91bycpij69uy.oastify.com). The package has empty author and description fields, a single published version, and no other code paths — the exfiltration beacon is its only purpose, matching the standard dependency-confusion / OOB-beacon pattern. Whether deployed as research or as a live attack, installing the package leaks identifying host data and sensitive system files to an attacker-controlled out-of-band endpoint.

Source: amazon-inspector (8a4e552337fa70064e0a04644ee5a64378809a85b281eda24707bc9a6eba473f)