easypanel-agent@1.0.0

Analysis

The preinstall hook (preinstall.js) runs on install and collects the host's hostname, username, current working directory, and the names of CI-related environment variables, then exfiltrates this data to the remote host easypanel-agent[.]daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com via both a DNS lookup (data chunked into the subdomain) and an HTTP request to /npm/<payload>. The package is a client library with no repository and no declared purpose for this network activity.