ect-839201@100.0.1

Analysis

The preinstall hook in this package reads /flag.txt from the host and exfiltrates it: it first tries to copy it to web-accessible static directories (/app/public/static/flag.txt, /app/static/flag.txt), and if both fail it uses curl to POST the file content to an attacker-controlled IP (10[.]107[.]121[.]85:8000/flag). The package is version 100.0. This is a flag-stealing payload targeting environments where a /flag.txt exists.