cpcz-common@22.1.1

Analysis

cpcz-common@22.1.1 runs a preinstall hook (node index.js) that collects system information — hostname, platform, architecture, username, uid, gid, shell, whoami output, current working directory, and CPU count — and POSTs the data as JSON to hxxps://p7xaw8rwxljb2hay3ann6pblgcm3atyi[.]oastify[.]com/detox56. The package has no legitimate functionality; it is a system-reconnaissance implant that exfiltrates host metadata on install.