node-stack-frames@4.0.0

Analysis

The node-stack-frames@4.0.0 package is an empty package (single version, "Security holding package" description) from a throwaway publisher ([account]) whose sole purpose is its preinstall hook. On `npm install`, the hook runs node -e to collect hostname, platform, and arch metadata, base64-encode it, and GET it to an attacker-controlled OAST callback endpoint (d8lslmi9io6i264ftj80mh9e7niqiaenf[.]oast[.]live). This is a classic host-reconnaissance beacon — postinstall host fingerprinting to an external sink designed to identify targets for follow-on attacks. No token-theft markers found, but the entire package is a single-purpose recon exfiltation payload.