computerrock-babel-preset-react-app@15.12.11

Analysis

The combosquat package computerrock-babel-preset-react-app (typo-squatting babel-preset-react-app from Create React App) runs an automatic preinstall script (node index.js) during npm install. This script collects detailed system information — hostname, current user (whoami, id), working directory (pwd), platform, architecture, home directory, username, uid/gid, shell, OS type/release, total/free memory, and CPU count — and POSTs it as a JSON payload to hxxps://0bccssrkeubggq24k750nrw0erki88wx[.]oastify[.]com/detox56 (an attacker-controlled OAST/interaction-capture server). No user interaction required; the exfiltration is silent.