afterpay-sdk-example-server@1.2.1

Analysis

Package afterpay-sdk-example-server (a combosquat name on the Afterpay payment brand) runs a preinstall hook that executes index.js during npm install. The script collects system reconnaissance data — hostname, username, home directory path, DNS server list, and the full contents of /etc/passwd and /etc/hosts — then exfiltrates them via HTTPS POST to a Burp Collaborator server at xqrangwae3pk5bd12xbr6t8q9hfc32rr[.]oastify[.]com. This is a system-information beacon designed to gather environment intelligence from the victim's machine.