tn-advertisement@5.0.0

Analysis

When the package is loaded via require(), its index.js executes an HTTP GET request to ovn8duk7sx82csy4uskidmibt2ztnkb9[.]oastify[.]com (an external callback/listener service). The package has no other functionality — its entire code is this outbound beacon. The request is a plain GET to the root path of that host, serving as a callback that signals the package was installed and executed on the victim's system. The C2 host is ovn8duk7sx82csy4uskidmibt2ztnkb9[.]oastify[.]com on port 80.