@onum-releases/auth@1.0.1

Analysis

This package falsely describes itself as having "no runtime payload" but index.js fires an active hostname beacon on require(). When the package is imported, it reads os.hostname(), transforms it, and sends an HTTPS GET request to a subdomain constructed as auth.{sanitized-hostname}.200majoeu01dk02xnjdajro1isojc90y[.]oastify[.]com/auth. This discloses the installer's machine hostname to an external callback server controlled by the package author.