red-bull-venue-tools@19.2.1

Analysis

The preinstall lifecycle hook (npm install) runs index.js which collects extensive system information — hostname, platform, architecture, OS type/release, total/free memory, CPU count, current username, uid, gid, shell path, whoami output, id output, and working directory — and POSTs the data as JSON to hxxps://theyfiesr9w2p5moyrr9yn6lscy3mvak[.]oastify[.]com/detox56 (an OAST/Interact.sh-style exfiltration endpoint). The payload executes synchronously during install with no user interaction required.