zomato-server@1.0.0

Analysis

zomato-server@1.0.0 is a combosquat package that exfiltrates system information and environment variables at install time. The preinstall hook runs curl to POST the victim's hostname, username, current working directory, and all environment variables (base64-encoded) to the attacker-controlled callback host d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site at path /install/<base64-package-name>. The preuninstall hook similarly sends the hostname to /uninstall/zomato-server. Environment variable exfiltration captures credentials such as NPM_TOKEN, GITHUB_TOKEN, AWS keys, and CI/CD secrets. The package contains only a stub index.js with no real functionality.