ckeditor5-ckbox@5.0.0

Analysis

The preinstall hook (node index.js) runs on install and collects host system information — current username, user/group IDs, shell, working directory, hostname, OS type/release, architecture, memory and CPU details — then POSTs it as JSON to the attacker-controlled endpoint hxxps://shoudanbid9mc4e6jlezjmldk0erki88wx[.]oastify[.]com/system-info. The package name impersonates the legitimate ckeditor5-ckbox CKEditor integration.