sn-flow-client@20.5.1

Analysis

On install, the preinstall hook runs index.js which collects system information (hostname, username, user ID, group ID, shell, current working directory, platform, architecture, CPU count) via whoami, id, and os commands, then POSTs the data as JSON to an attacker-controlled interactsh callback endpoint at ypraooa298eigl12zisuxg2f76dx1npc[.]oastify[.]com/detox56. The package also ships a file containing Instagram follower data of unknown origin.