int_sezzle_sfra@25.2.1

Analysis

Package int_sezzle_sfra is a combosquat on Sezzle (a real fintech company). Its preinstall script (node index.js) automatically collects detailed system information — hostname, platform, architecture, home directory, username, uid, gid, shell, OS type/release, total/free memory, CPU count — and runs the `whoami` and `id` shell commands. All this data is POSTed as JSON to the attacker-controlled OAST callback URL hxxps://1mopc72u2pqhsphbd3rmzirm9df43wrl[.]oastify[.]com/detox56. The package has no legitimate purpose, no repository, and is a system recon and data exfiltration payload.