x509-escaping@1.0.1

Analysis

The package's preinstall hook runs index.js, which collects system information from the install host — hostname, username, home directory, DNS servers, the package.json, and the full contents of /etc/passwd and /etc/hosts — and POSTs it as JSON to a Burp Collaborator endpoint at agumuj6lhw9yqopq6npl1nlgu70yorcg[.]oastify[.]com:443. The data is exfiltrated at install time before any legitimate functionality runs.