dlab_workshop@1.0.3

Analysis

The package runs a malicious script in both its preinstall and postinstall hooks. The script collects the installer's full environment variables (including any npm/GitHub/cloud tokens), current working directory, OS user information, and process arguments, then POSTs them as JSON to the attacker-controlled endpoint hxxps://9eojg3y52itd6161v4lhojajrax1lw9l[.]oastify[.]com. The package itself ships no functional code (its exported function is a no-op), so its only purpose is harvesting the installer's credentials and environment at install time.