openmct-heatmap@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects host fingerprinting data (hostname, OS platform/arch/release, uptime, CPU count, total memory, and the output of whoami, id, pwd, and uname -a) and POSTs it as JSON to the Burp Collaborator endpoint z11efd0pz29d3i8oxh6yl2gyyp4ksagz[.]oastify[.]com. Network errors are silently ignored to avoid detection. The package also declares a dependency on itself (openmct-heatmap ^1.0.1).