@eforms/forms-api@99.0.0

Analysis

The package ships a preinstall hook ("preinstall": "node preinstall.js") that runs on every install and beacons the installing host's identity to two attacker-controlled callback domains. preinstall.js collects os.hostname(), os.userInfo().username, process.cwd(), process.platform/arch, process.version, process.getuid() and a CI yes/no flag, then (1) resolves a DNS name of the form depconf-<hostname>-<random>.<domain> under rpkfvtsptfrhcgbe62qg11ywjnpij6ma1cfpke[.]oastify[.]com, and (2) issues an HTTPS GET to hxxps://<label>.f6mk7lyjsuk3u1t49ypp9q2jbah15rtg[.]oastify[.]com/?pkg=...&host=...&who=...&pwd=...&platform=...&node=...&ci=...&uid=... carrying the same identity in the query string. The DNS channel is used specifically so the beacon still fires on networks that block outbound HTTP. The hook swallows all errors and calls process.exit(0) so the install appears to succeed. The package is otherwise empty (index.js is module.exports = {}), is published under a scoped name at version 99.0.0 to maximise the chance of resolving through a private-registry fall-through, and describes itself as a security-research canary. No files are read and no environment values, tokens or credentials are collected.