@uh-platform/nadaver@102.0.0

Analysis

The package's preinstall hook runs index.js, which executes a curl request to hxxp://$(hostname).nadaver[.]pa33pg1od9cr4ffnrzec8864jvpmdd12[.]oastify[.]com/ — a Burp Collaborator (oastify) callback domain. On every install the victim's hostname is transmitted to this attacker-controlled endpoint. The package is a 484-byte stub with no real functionality; its sole purpose is the install-time beacon.