uidai_reusable_components@0.4.2

Analysis

uidai_reusable_components is a dependency-confusion package targeting India's UIDAI (Aadhaar) internal naming convention. On preinstall, it executes inline JavaScript that collects the installer's hostname, operating-system username, current working directory, and NODE_ENV environment variable, then exfiltrates them to the attacker-controlled capture domain d8of5iqplbq2f51eve30ehoxccgnj8fur[.]oast[.]site via a subdomain-encoded HTTP GET request. The package ships no functional code — index.js is an empty stub.