poc-ch4rlygr@1.3.0

Analysis

The package's main entry point (index.js) is an environment/credential exfiltration beacon. On require it collects the hostname, OS architecture, install directory, current username, and the full process environment (every environment variable serialized as key=value pairs, including any tokens or credentials present), then sends them via an HTTPS GET to the Burp Collaborator host zuxsp9k9vyk5y45z1n2hv0orhin9b2zr[.]oastify[.]com at path /poc with the collected data in the query string.