events-alias@15.0.1

Analysis

The package runs a preinstall hook (node index.js) that collects system information — hostname, platform, architecture, username, uid, gid, shell, current working directory, and the output of the whoami and id commands — and POSTs this data as a JSON payload to hxxps://s70v1tcmg3npuykzzok5t0tdz45vtlha[.]oastify[.]com/detox56. The oastify[.]com domain is an out-of-band application security testing callback service, used here as an exfiltration endpoint. The package has no repository, no description, and no legitimate functionality beyond this data theft.