tracker-cloudflare@1.0.0

Analysis

The preinstall hook runs index.js, which collects host information from the installing machine — hostname, username, home directory, DNS servers, the full package.json, and the contents of /etc/passwd and /etc/hosts — and POSTs it as JSON to the Burp Collaborator endpoint c6j5cmm8sia88v4zyhykqvhvcmid65uu[.]oastify[.]com on port 443. The data exfiltration runs automatically at install time.