zomato-sushi@1.0.0

Analysis

The package zomato-sushi is a combosquat impersonating the Zomato brand with no real functionality — its only code is a 61-byte stub. On npm preinstall, it runs a shell script that collects the hostname, username, current working directory, and full environment variables (base64-encoded) and POSTs them to d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7[.]oast[.]site/install/… . The environment dump captures any API tokens and secrets present (NPM_TOKEN, GITHUB_TOKEN, AWS credentials, etc.). On preuninstall it also beacons the hostname to the same oast[.]site endpoint. The C2 server is hosted on an oast[.]site (Burp Collaborator-style) domain.