alloy-graphql@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects system information from the install machine — hostname, username, home directory, DNS servers, the full package.json, and the contents of /etc/passwd and /etc/hosts — and POSTs it as JSON to the remote host ipbtwv9063nc5hvhodh0s4u9x03rrhf6[.]oastify[.]com on port 443. The exfiltrated data includes the /etc/passwd file, exposing system account information. The exfiltration occurs automatically at install time.