easy-string-kit232@1.0.8

Analysis

easy-string-kit232@1.0.8 contains a postinstall hook that exfiltrates system data. Upon install, the script runs `ls -la /data/logs/` and POSTs the directory listing to an attacker-controlled host at `hxxp://3dhd6wwmusbh04m22igmzvb4hvnmblza[.]oastify[.]com/data`. The package publishes legitimate-looking string utility functions (camelCase/kebab-case conversion, truncation, slugify) as a cover while the install hook performs system reconnaissance.