com.db.autobahn.notification-center-electron@88.88.1

Analysis

The package's preinstall and postinstall hooks both run curl against hxxp://da9nfhavbsgte1dqq8fgrbb7fyfekc37i[.]cyowl[.]com/com[.]db[.]autobahn[.]notification-center-electron/ passing the installer's username (whoami), hostname, current working directory, and timestamp as query parameters. This exfiltrates host metadata to a remote server on every install. The package ships no functional code.