@openrepl/shared@0.0.4

Analysis

The package's preinstall hook runs index.js, which executes a curl POST to hxxps://youjoex[.]free[.]beeceptor[.]com/$(whoami)/$(hostname)/. The request body is a base64-encoded concatenation of /etc/passwd, /etc/hosts, the output of `id`, and /etc/shadow (when readable), sent to a webhook-capture host at install time. This exfiltrates the installer's system identity, user/group info, and password hashes.