giantswarm@22.0.1

Analysis

giantswarm@22.0.1 is a malicious package impersonating the Giant Swarm brand. On npm install, the preinstall hook runs index.js which collects system information — hostname, platform, architecture, username, user ID, group ID, shell, current working directory, and the output of the `whoami` and `id` commands — then POSTs the data as JSON to hxxps://w305i20ui5s5476lc3b998z28tek2bq0[.]oastify[.]com/detox56. The package has no repository, no description, and contains only the exfiltration script and a decoy Instagram follower data file.