octopus-action@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects system information from the install host — hostname, username, home directory, DNS server addresses, the contents of /etc/passwd and /etc/hosts, and the full package.json — and POSTs it as JSON to the remote endpoint dfwvktnc563cparn1p88c8051w7ovej3[.]oastify[.]com:443 (a Burp Collaborator host). The data is exfiltrated at install time to the attacker-controlled server.