global-intel@1.0.1

Analysis

The package's preinstall hook runs index.js, which reads /etc/passwd and /etc/hosts plus system metadata (hostname, username, home directory, DNS servers, package.json) from the install machine and POSTs them as JSON to the attacker-controlled host 0gh240ybp2rb80iyzrg4w2o3tuzlncb1[.]oastify[.]com on port 443. This is an install-time data-exfiltration beacon that ships sensitive local files to a remote endpoint.