@muaththir/api@2.0.0

Analysis

This package has no real functionality. Its package.json declares a preinstall lifecycle hook that silently executes a bundled index.js at install time (output redirected to /dev/null). The script gathers host and user reconnaissance, including the current OS username, working directory, Node.js version, platform and architecture, plus a randomly generated execution id and timestamp, and exfiltrates this data as JSON via an HTTPS POST to an attacker-controlled external endpoint. This runs automatically on npm install with no user interaction.