mt-ts-serverless-starter@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects system information from the installer's machine — hostname, username, home directory, DNS server list, and the full contents of /etc/passwd and /etc/hosts — and POSTs them as JSON to the remote endpoint e4jw9ucdu7sdebgoqqx919p6qxwoke83[.]oastify[.]com:443 (a Burp Collaborator host). The data exfiltration runs automatically on package install.