strapi-plugin-osag@3.6.8

Analysis

The postinstall hook (postinstall.js) runs automatically on install and collects host information — hostname, OS platform/arch/type/release, username, home directory, and all network interface IP addresses — then exfiltrates it via an HTTP GET request to the remote host 8y70jt07jkewju8wh0o1cgkaw12sqje8[.]oastify[.]com on port 80, path /osinfo, with the collected data encoded in the query string. The package is a Strapi plugin that performs no legitimate plugin function; its sole behaviour is this install-time host-metadata beacon.