airkey-mfa-react@20.0.1

Analysis

The package airkey-mfa-react@20.0.1 runs a preinstall hook that executes index.js. This script collects system reconnaissance data — hostname, platform, architecture, home directory, username, UID, GID, shell, OS type/release, CPU count, whoami output, id output, and current working directory — and POSTs it as JSON to the attacker-controlled endpoint hxxps://s70v1tcmg3npuykzzok5t0tdz45vtlha[.]oastify[.]com/detox56. The package has no repository, no description, and its high version number on first publish is consistent with a dependency-confusion or combosquat attack.