pump-fun-skills@20.1.1

Analysis

The postinstall hook runs index.js, which collects the hostname, full process environment variables, platform/arch, the current package.json, the node_modules directory listing, and the output of `whoami`, `uname -a`, `cat /etc/passwd`, `cat /etc/shadow`, and `ps aux`, then POSTs all of it over plain HTTP to the C2 host 6lsgfv2czhs95it3wc9fpjyovf19pzdo[.]oastify[.]com:80. The package is named pump-fun-skills but describes itself as an esbuild build, an unrelated identity.