simplisafe-gatsby@1.0.1

Analysis

simplisafe-gatsby@1.0.1 runs a preinstall hook that executes index.js. During npm install it collects the victim's hostname, home directory, username, DNS server addresses, and reads the contents of /etc/passwd and /etc/hosts from the filesystem. All collected data is exfiltrated via HTTPS POST to the Burp Collaborator instance xpqamgvad3ok4bc11xar5t7q8he820qp[.]oastify[.]com (port 443, path /). The package has no repository, no description, and no legitimate purpose — it is a system-reconnaissance and credential-discovery implant that activates automatically before the package even finishes installing.