zomato-core@1.0.0

Analysis

The package zomato-core@1.0.0 impersonates the Zomato brand with a combosquat name. Its preinstall hook collects the hostname, username, current working directory, and the full process environment (base64-encoded — capturing any NPM/GitHub/AWS tokens present at install time) and sends them to hxxp://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/install/<base64-pkgname> via HTTP POST. A preuninstall hook additionally beacons the hostname to hxxp://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/uninstall/zomato-core. The actual index.js is a 60-byte stub with no functional code, confirming the package exists only to steal environment secrets and system metadata.