dependencyfsdsfdsfg@99.9.0

Analysis

The package's postinstall hook runs index.js, which collects the installer's username (via whoami), hostname, current working directory, and local IPv4 addresses and sends them to the remote endpoint hxxps://xghhv5sajm33m7krgi4n8my0mrsig84x[.]oastify[.]com via an HTTPS GET on install. This is a covert host-metadata beacon that reports the victim machine's identity and network details to an attacker-controlled oastify sinkhole host.