@uwr/colors@1.3.6

Analysis

On install, the postinstall script (scripts/postinstall.js) silently sends the machine's hostname via DNS lookup to the callback domain 0ab1mctv5xigbskwtfusp77dj4pvdx1m[.]oastify[.]com. The script constructs a subdomain from the sanitized hostname and performs a dns.lookup(), exfiltrating the hostname to the OASTify listener. The package's main export (src/index.js) is a decoy color-tokens module (hex color constants) with no connection to the postinstall behaviour.