blinkit-core@1.0.0

Analysis

The preinstall hook exfiltrates the installer's hostname, username, current working directory, and ALL environment variables (base64-encoded via `env | base64 -w0`) to `d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/install/<base64-package-name>` via curl over HTTP. A preuninstall hook also sends the hostname to `d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/uninstall/blinkit-core`. The package's `index.js` is a 61-byte stub exporting only name and version; the hooks are the entire payload, designed to capture npm tokens, GitHub tokens, cloud credentials, and any other secrets present in the shell environment at install time.