strapi-plugin-os-rec@3.6.8

Analysis

The postinstall hook (postinstall.js) runs automatically on install and collects host information — hostname, OS platform/arch/type/release, username, home directory, all network interface IP addresses, and the PATH/USER/HOME environment variables — then exfiltrates it as an HTTP GET query string to the remote host 8y70jt07jkewju8wh0o1cgkaw12sqje8[.]oastify[.]com on port 80 (path /osinfo). The package is a Strapi plugin that performs no plugin functionality; its only behaviour is this host-information beacon to an external endpoint.