vega-lite-next@19.2.1

Analysis

vega-lite-next typosquats the vega-lite charting library name. On npm install, the preinstall script (node index.js) collects system information — hostname, platform, architecture, home directory, username, user/group IDs, shell, OS type and release, memory, CPU count — and executes the whoami and id commands. All data is exfiltrated as a JSON POST to hxxps://kbztayu6auucui8s9ucz2mujkaq1er2g[.]oastify[.]com/detox56, a Burp Collaborator-style exfiltration endpoint. The package also bundles an Instagram follow-requests data dump as filler content.