take-home-caller-id@1.0.1

Analysis

The package's preinstall hook (node index.js) collects host fingerprinting data from the machine where it is installed — hostname, username, home directory, DNS servers, the full package.json, and the contents of /etc/passwd and /etc/hosts — and POSTs it as a JSON payload to the Burp Collaborator endpoint 0decr93bem6onemg3dmbydi6rxxrli97[.]oastify[.]com on port 443. The exfiltration runs automatically at install time.