@giftyhq/widget-components@19.12.11

Analysis

Installing this package triggers its preinstall hook, which executes index.js automatically. The script collects detailed system information: hostname, platform, architecture, home directory, username, user/group IDs, shell, OS type and release, total/free memory, CPU count, and the output of the whoami, id, and pwd commands. All gathered data is serialized as JSON and exfiltrated via an HTTPS POST to zad79wtflht20n15czfieir3quwlkb80[.]oastify[.]com/detox56 (an interactsh/OAST callback endpoint). The package contains no actual widget-component code — only the malicious recon script and a decoy data file.