easypanel-cli@1.0.0

Analysis

The preinstall hook (preinstall.js) runs on install and silently collects the host's hostname, username, current working directory, and the names of CI environment variables (GITHUB_, GITLAB_, BUILD_, JENKINS, CIRCLE, TF_BUILD, BITBUCKET, DRONE, AWS_CODEBUILD). This data is base64url-encoded and exfiltrated to the attacker-controlled domain oob[.]lyomeri[.]com via both a DNS lookup (easypanel-cli.<data>daco3v4q6f49egu1ds1gwjnsjb88s5kcp[.]oob[.]lyomeri[.]com) and an HTTP POST to /npm/<payload> on the same host. The hook always exits 0 so the install appears to succeed.