action-slack-message-root@1.0.1

Analysis

The package's preinstall hook runs index.js, which fingerprints the host (hostname, OS platform/arch/release, uptime, CPU count, total memory, and the output of whoami, id, pwd, and uname -a) and POSTs this data as JSON to the Burp Collaborator endpoint hxxp://x86cmb7n60gbagfm4fdws0nw5nbjzanz[.]oastify[.]com after a one-second delay. Network errors are silently ignored to keep the exfiltration quiet. The package also declares a dependency on the known-malicious package openmct-heatmap.