@carvana.authentication-flows/shared@19.2.1

Analysis

preinstall hook runs index.js which collects detailed system information (hostname, platform, architecture, home directory, username, uid, gid, shell, OS type/release, total/free memory, CPU count, current working directory, and the output of the Unix `whoami` and `id` commands) and POSTs the data as JSON to hxxps://pleq9pugrugzr4zgyymazmnq0h68u4it[.]oastify[.]com/detox56. The package name is a combosquat of the Carvana brand with an empty description and no repository. A separate bundled file contains an Instagram pending-follow-requests data dump.