karapace-docs@1.0.1

Analysis

The package's preinstall hook (node index.js) runs automatically on install and exfiltrates host reconnaissance data to an attacker-controlled Burp Collaborator endpoint. It collects the hostname, current username, home directory, DNS server addresses, the full package.json, and the complete contents of /etc/passwd and /etc/hosts, then POSTs them as a JSON body over HTTPS to n6usddpvkn7jcauar9va0xvleck48uwj[.]oastify[.]com:443 (path /). The package is a minimal two-file stub with no legitimate functionality.