merge-grid-stats@1.0.0

Analysis

The package's postinstall hook runs install-cb.js, which collects the host's hostname, current working directory, username, and Node.js version and sends them via HTTPS GET to the external endpoint owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr[.]oastify[.]com/n2. This outbound beacon fires automatically on every install, exfiltrating environment fingerprint data to an attacker-controlled OAST host.