zomato-config@1.0.0

Analysis

zomato-config@1.0.0 is a trojanized clone impersonating Zomato, containing no real configuration management functionality. The preinstall hook exfiltrates the installer's hostname, username, current working directory, and ALL environment variables (base64-encoded) to an interactsh callback server via curl: d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/install/<base64>. A preuninstall hook also phones home with the hostname. The env capture steals any credentials, API tokens, or secrets present in environment variables (NPM_TOKEN, GITHUB_TOKEN, AWS_* etc.) at install time.