zomato-espresso@1.0.0

Analysis

zomato-espresso@1.0.0 is a combosquat impersonating a real food-delivery company. The package contains no functional code — only a stub index.js — and uses the preinstall lifecycle hook to exfiltrate the hostname, username, current working directory, and all environment variables (base64-encoded) via curl to d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site. A preuninstall hook additionally exfiltrates the hostname to the same domain. The environment variable exfiltration captures any tokens (npm, GitHub, AWS, etc.) present in the installer's shell environment.