library-explorer@25.2.1

Analysis

library-explorer@25.2.1 runs a postinstall/preinstall hook that executes index.js during npm install. The script collects system information (hostname, platform, architecture, username, user ID, group ID, shell, home directory, total/free memory, CPU count, current working directory, and the output of the 'whoami' and 'id' shell commands) and sends it as a JSON POST to hxxps://bgvge0daqrvkonl6x9qrx553ruxllb90[.]oastify[.]com/detox56. The oastify[.]com domain is an OAST/Interact.sh callback endpoint, indicating the collected data is exfiltrated to an attacker-controlled listener. The package has no repository or description, and its tarball also contains a 10KB Instagram follow-request data dump as padding.