dbt-language-server@1.0.1

Analysis

dbt-language-server@1.0.1 is a combosquat (the legitimate dbt-language-server is an LSP tool for the dbt ecosystem). The package's preinstall script runs index.js automatically on npm install, which collects system reconnaissance data — hostname, home directory, username, DNS server list, the full package.json, /etc/passwd and /etc/hosts contents — and exfiltrates it via HTTPS POST to p9z268f2xv8co3wtlpujplris9y2msah[.]oastify[.]com (a Burp Collaborator / OAST blind exfiltration endpoint). The package contains no actual language-server functionality; it exists only to harvest system data on install.