@onum-releases/utils@1.0.1

Analysis

Package @onum-releases/utils@1.0.1 runs a hostname reconnaissance beacon when required in Node.js. The index.js file reads os.hostname(), constructs the subdomain 'utils.<hostname>.200majoeu01dk02xnjdajro1isojc90y[.]oastify[.]com', and issues an HTTPS GET to '/utils' on that host — exfiltrating the hostname to an attacker-controlled OAST/intercept-style callback domain. The package description falsely claims "no runtime payload."