harmony-app-toolkit@21.0.0

Analysis

The package's preinstall hook (node preinstall.js) reads a hex-encoded command from preinstall.json and executes it. The decoded command runs curl against hxxps://eoustf8gflamm91[.]m[.]pipedream[.]net with a POST body containing the output of whoami, pwd, hostname, and cat /etc/passwd, exfiltrating host identity and the system passwd file to the remote endpoint at install time.