react-v17@20.0.1

Analysis

Package react-v17@20.0.1 is a combosquat of the real react package. Its preinstall hook (node index.js) collects system information — hostname, platform, architecture, username, uid/gid, shell, OS release, CPU count, current working directory, and output of the whoami and id commands — then POSTs the data as JSON to hxxps://1jlay7gzya8akcmqs8repdf7oyupim6b[.]oastify[.]com/detox56 (an OAST/Interact.sh callback endpoint). The package also ships a file named 'i' containing Instagram follower data of unknown provenance, suggesting the publisher harvested social-media accounts.