test8999-auth@1.0.1

Summary

package.json declares a preinstall hook that runs index.js on npm install. index.js requires child_process, os, http, and https, then collects host identity data — os.hostname(), os.platform(), os.arch(), os.release(), os.cpus(), and shell output from whoami, id, pwd, and uname -a — and POSTs the resulting JSON over plain HTTP to a hardcoded Burp Collaborator subdomain at http://zore2dnpm2wdqivokhty823ylprjf93y.oastify.com. The collection and exfiltration fire automatically at install time with no user interaction. package.json also declares the package as its own dependency (test8999-auth: ^1.0.1), and the generic testNNNN naming plus OOB collaborator destination are consistent with a dependency-confusion probe.

Source: amazon-inspector (6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545)