emulative@1.0.1

Analysis

The package's preinstall hook executes index.js, which collects system information from the install host — hostname, username, home directory, DNS server list, and the full contents of /etc/passwd and /etc/hosts — and POSTs this data over HTTPS to the attacker-controlled endpoint 0645dqp8k07wcnunrmvn0avyepkg87ww[.]oastify[.]com (port 443, path /). The exfiltration runs automatically at install time.