test8999-auth@1.0.1

Analysis

The package's preinstall hook (node index.js) runs a device-fingerprinting beacon on install. It collects hostname, platform, architecture, OS release, uptime, CPU count, total memory, the current user (whoami), uid/gid (id), working directory (pwd), and uname -a output, then POSTs this data as JSON to the Burp Collaborator endpoint hxxp://zore2dnpm2wdqivokhty823ylprjf93y[.]oastify[.]com. Network errors are silently ignored to keep the exfiltration quiet.