@avigilon/node-webrtc@2.1.4

Analysis

The package's preinstall hook runs index.js, which collects host metadata (hostname, home directory, username, DNS server addresses, and the package.json contents) and POSTs it over HTTPS to the attacker-controlled Burp Collaborator endpoint mj9ouelpgm0d26s3wp0syow03r9ix8lx[.]burp[.]attack[.]live on port 443. The data is sent as a form-encoded body on every install. This is an install-time host-recon beacon to a remote server.