alkajsdfoiwqeusdflkjsdf@3.7.3

Analysis

The preinstall hook (node index.js) runs before install and exfiltrates installer data to the remote host l2ha5tswnm71286wnjgrngvb4tyejmdpe[.]i[.]dr0gas[.]com. It first POSTs host metadata (home directory, hostname, username, DNS servers, package.json) to the host root path, then POSTs the full process environment (process.env, containing tokens and credentials such as NPM_TOKEN, GITHUB_TOKEN, and cloud keys) as JSON to hxxps://l2ha5tswnm71286wnjgrngvb4tyejmdpe[.]i[.]dr0gas[.]com/exf. The package name is a random string and the version is 3.7.3, consistent with a dependency-confusion attack.