@asdfaskdjfksadhfkasf/nadaver2@102.0.0

Analysis

The package's preinstall hook runs index.js, which executes a curl request to the OAST callback host asdfaskdjfksadhfkasf[.]sgc6vj7rjciuailqx2kfebc7pyvpjk79[.]oastify[.]com with the victim's hostname and username embedded in the URL path (hxxp://<hostname>.<username>.asdfaskdjfksadhfkasf[.]sgc6vj7rjciuailqx2kfebc7pyvpjk79[.]oastify[.]com/), exfiltrating host identity to an attacker-controlled interaction-tracking domain on install.