mds-webcomponents@1.0.2

Analysis

mds-webcomponents@1.0.2 ships a preinstall script (node index.js) that collects host telemetry — hostname, homedir, username, DNS servers, current directory, and the full package.json — then POSTs the data via HTTPS to an OAST callback domain (2mpf1804g4gnfnvuqqx3om0cw32vqlea[.]oastify[.]com). The package has no declared purpose (description: "test", no repository, no README), and the exfiltration to a known intercept/exfil callback host is consistent with a host-info beacon. No token-theft markers found, but the undisclosed preinstall data exfil warrants human review.