easypanel-docker@1.0.0

Analysis

The preinstall hook (preinstall.js) runs on install and silently collects the host's hostname, OS username, current working directory, and the names of CI/build environment variables, then base64url-encodes this metadata and exfiltrates it to the domain oob[.]lyomeri[.]com via two channels: a DNS lookup to easypanel-docker.<data>.daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com and an HTTP POST to easypanel-docker[.]daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com/npm/<data>. The package is named easypanel-docker and describes itself only as a "client library".