dojo-rn-interview@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects system information from the installing machine — hostname, username, home directory, DNS servers, install path, and the full contents of /etc/passwd and /etc/hosts — and POSTs this data over HTTPS to the Burp Collaborator endpoint kqepxa9s4krgw7e7b6f7kufiy943stgi[.]oastify[.]com. The exfiltrated data includes the local /etc/passwd file, exposing system account information. The exfiltration runs automatically on install with no user interaction.