xpna-context@1.0.2

Analysis

xpna-context@1.0.2 executes host reconnaissance at install time via its preinstall hook. The hook runs shell commands that transmit the installer's hostname to an attacker-controlled OAST callback server (je15qppk9nkf2oim0q2cty8n5eb6zwnl[.]oastify[.]com). Additionally, a bundled JS file (injex.js) collects the hostname, user info, and all environment variables and POSTs them as JSON to a second endpoint (j3n5fpekyn9fro7mpqrciyxnue05ozco[.]oastify[.]com/Log). This captures any credentials, API keys, or tokens present in the environment variables of the system where the package is installed.