test89078-auth@99.99.99

Analysis

The preinstall hook (node index.js) collects the machine hostname and the current username via os.hostname() and os.userInfo().username, concatenates them, and exfiltrates them through a DNS lookup to a subdomain of the attacker-controlled domain dnshook[.]site (31ee29fe-db68-4fd3-86a2-2b707b9e95f0[.]dnshook[.]site). The DNS query encodes the host identity data in the subdomain label, silently beaconing the victim's machine identity to the remote server on every install.