atlassian-forge-skills@29.1.0

Analysis

Package `atlassian-forge-skills` combosquats the official Atlassian Forge SDK. The `preinstall` lifecycle hook runs `index.js`, which uses `os.hostname()` to read the installer's machine hostname, constructs the domain `{hostname}.zcagyqqmvnmgsklstrrr6xo2715tov7wz[.]oast[.]fun`, and sends a DNS lookup to that attacker-controlled interactsh callback server — exfiltrating the machine identity to the attacker. The publisher (`lapdeplap` / `[account]`) is a throwaway identity not affiliated with Atlassian. IOC: oast[.]fun domain `zcagyqqmvnmgsklstrrr6xo2715tov7wz[.]oast[.]fun`.