rtms-manager@1.0.0

Analysis

rtms-manager@1.0.0 is a dependency-confusion package with a preinstall hook (node index.js) that exfiltrates the installer's username and hostname via DNS to an oastify[.]com (Interactsh) callback domain. On installation, the script runs os.userInfo().username and os.hostname(), constructs a domain cb.{username}.{hostname}.vih5w2ef1odmsfe6uuuz1nvksby2mvak[.]oastify[.]com, and performs a dns.lookup to the oastify[.]com domain — a blind out-of-band exfiltration technique. The package has no legitimate functionality and is published only to execute this beacon.