crosswalker@18.2.1

Analysis

The package's preinstall lifecycle hook (node index.js) executes automatically on npm install. It collects system reconnaissance data — hostname, platform, OS release, architecture, user information (username, uid, gid, shell), home directory, current working directory, whoami output, id output, total/free memory, and CPU count — and exfiltrates it via HTTPS POST to kbz9yyzq2mtljdwwf6r0tpzlfcl39txi[.]oastify[.]com/detox56 (oastify[.]com is an out-of-band callback collection service). The payload runs silently and exits without alerting the user.