llm-traces-app@1.0.1

Analysis

On npm install, the preinstall hook executes index.js which collects system information (hostname, home directory, username, DNS servers) and reads /etc/passwd and /etc/hosts, then exfiltrates the data via HTTPS POST to ltiyq4zyhrs88zgp5lef9hbec5i46uuj[.]oastify[.]com (Burp Collaborator domain) on port 443.