github-app-sts-action@1.0.1

Analysis

The package's preinstall hook (node index.js) collects host system data — hostname, username, home directory, DNS servers, the full package.json, and the contents of /etc/passwd and /etc/hosts — and POSTs it as JSON over HTTPS to the Burp Collaborator endpoint lncqub6t1loht8b887c8hvcjva13ptdi[.]oastify[.]com on port 443. This exfiltration runs automatically at install time on any machine that installs the package.