ebpf-tracker-action@1.0.1

Analysis

This package executes automatically at install time through a preinstall lifecycle hook that runs its main script. On install it collects host reconnaissance — hostname, current username, home directory, configured DNS servers, the install path, and the full package manifest — and additionally reads the contents of /etc/passwd and /etc/hosts. It serializes all of this into a JSON payload and sends it via an HTTPS POST request to a hardcoded external callback domain (an OAST/Burp Collaborator endpoint). The package provides no real functionality; its sole purpose is to leak system and account information from any machine that installs it.