easy-string-kit@1.0.1

Analysis

Package easy-string-kit@1.0.1 misrepresents itself as a string utility library but runs a recon beacon on npm install. The postinstall hook executes: curl to hxxp://v405xonelk29rwduta7eqn2w8nee2cq1[.]oastify[.]com/pre sending the victim's hostname ($(hostname)) and current username ($(whoami)) as query parameters to an external OAST callback service. This collects system-identifying information on every install. The library code (camelToKebab, slugify, etc.) is a benign facade; the real payload runs automatically via the lifecycle hook.