easypanel-deploy@1.0.0

Analysis

The package's preinstall hook (preinstall.js) runs on install and collects host fingerprint data — hostname, username, current working directory, and the names of CI-related environment variables present (GITHUB_, GITLAB_, BUILD_, JENKINS, CIRCLE, TF_BUILD, BITBUCKET, DRONE, AWS_CODEBUILD). It base64url-encodes this and exfiltrates it to the attacker-controlled host easypanel-deploy[.]daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com via both a DNS lookup and an HTTP GET to /npm/<encoded-data>. The exfiltration is wrapped in try/catch and always exits 0 so the install appears to succeed.