poloman@9.2.1

Analysis

A pure reconnaissance beacon (629 bytes, no legitimate functionality). The preinstall hook runs index.js, which executes a shell command collecting hostname, working directory, username (whoami), and the full network interface configuration (ip a), hex-encodes the output with xxd, and exfiltrates it as a series of subdomain DNS queries to the OAST callback host n1pbc7bx5z3ed0c9ty8q6z4p3g97x0lp[.]oastify[.]com. An HTTP GET beacon is also sent to the same host via curl.