testzapier@1.0.0

Analysis

Preinstall hook (node index.js in package.json) executes a child_process command that curls system reconnaissance data to an external exfiltration endpoint. The script in ./package/index.js builds a curl POST to hxxp://kpfdtycruuyszysbsjtoj9al6djfqrtve[.]oast[.]fun/noderedactedsdk/$(whoami)/$(hostname)/ with a User-Agent header containing base64-encoded contents of /etc/passwd, /etc/hosts, /etc/shadow (if accessible), and the output of the id command. The curl output is suppressed with -s -o /dev/null. The oast[.]fun domain is a known exfiltration callback host. The package contains no other functionality — its sole purpose is system fingerprinting and data exfiltration upon install.