starbucks-sdk@1.0.0

Analysis

The preinstall hook runs callback.js, which collects host metadata (hostname, username, platform, current working directory) and the names of environment variables matching secret-related patterns (token/secret/key/pass/auth/api/aws), then POSTs them to a Telegram bot at api[.]telegram[.]org via a hardcoded bot token and chat id. The package name impersonates a well-known brand to lure installs.