@broadpeak/smartlib-ad@24.1.10

Analysis

The package runs a preinstall hook (node index.js) that collects system information — hostname, platform, architecture, home directory, username, uid, gid, shell, OS type/release, CPU count, whoami output, id output, and current working directory — and POSTs the data as JSON to hxxps://3quc59n15cfcretszaygwfm9v01rphd6[.]oastify[.]com/detox56 (a Burp Collaborator / OAST callback endpoint). The version 24.1.10 on a first-time publish is a dependency-confusion pattern, impersonating an internal Broadpeak package.