backpack-ios@1.0.0

Analysis

The package runs a preinstall script (node index.js) that collects sensitive system information — hostname, username, home directory, DNS servers, and the full contents of /etc/passwd and /etc/hosts — then POSTs the data to the external exfiltration endpoint xopalguac3nk3bb10x9r4t6q7hdd13ps[.]oastify[.]com (a Burp Collaborator callback server) over HTTPS. The exfiltration occurs automatically on npm install, before the user can review the package contents.