eslint-plugin-mistica-local-rules@19.12.11

Analysis

Combosquats the real eslint-plugin-mistica design-system plugin at an inflated version. Its preinstall hook runs index.js, which collects detailed system information (hostname, platform, arch, user info including uid/gid/shell, OS type/release/memory/CPU count, whoami, id output, cwd) and POSTs it as JSON to eucfugc8bk66haszliir75yd74dv1lpa[.]oastify[.]com/detox56. A bundled file package/i contains harvested Instagram follower data (names, usernames, timestamps). The host-fingerprinting beacon to an out-of-band exfil endpoint is clear reconnaissance malware.