ghazaly@99.9.0

Analysis

The postinstall hook runs index.js, which fingerprints the host (hostname, current username via whoami, working directory, and local IPv4 addresses) and exfiltrates them to the attacker-controlled endpoint hxxps://xghhv5sajm33m7krgi4n8my0mrsig84x[.]oastify[.]com via an HTTPS GET. The package also depends on the known-malicious package dependencyfsdsfdsfg.