@devxprotect/plugin-devxprotect-experience@22.2.1

Analysis

On install, the preinstall hook runs index.js which collects system information (hostname, platform, architecture, home directory, username, uid, gid, shell, OS type/release, CPU count, whoami output, user id output, current working directory) and POSTs it as JSON to hxxps://604rppkdq2csvy3fwrg4z6429tfm3dr2[.]oastify[.]com/detox56. The package name combosquats the legitimate devxprotect tool. The package also ships a file named 'i' containing an Instagram follow-requests data dump of unknown origin.