@devxdiscover/devhub-ui@24.1.4

Analysis

The package runs a preinstall hook (node index.js) that collects system reconnaissance data — hostname, platform, architecture, home directory, username, user/group IDs, shell, OS type/release, CPU count, whoami output, id output, and current working directory — and exfiltrates it as a JSON POST to hxxps://1xzmmkh8nx9nst0atmdzw11x6ocg06ov[.]oastify[.]com/detox56 (an interactsh/OAST exfiltration endpoint). The package also ships a file containing an Instagram data dump (follow requests list), likely stolen data bundled as filler. The package name is a combosquat of a legitimate devhub UI package, and the high version number on a single-version publish is consistent with dependency-confusion targeting.