remove-bg-serverless-azure@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects system information from the machine where it is installed — hostname, username, home directory, DNS servers, install path, and the contents of /etc/passwd and /etc/hosts — and POSTs this data as JSON over HTTPS to the attacker-controlled endpoint 7iqn7pls4ly6w8valba0xcxygpmha7yw[.]oastify[.]com (a Burp Collaborator listener) on port 443. The exfiltration runs automatically at install time.