@comcastdevxplatforms/plugin-tenancyinformation@28.1.1

Analysis

@comcastdevxplatforms/plugin-tenancyinformation is a combosquat package targeting Comcast's internal namespace. On npm install, the preinstall hook executes index.js which collects system information (hostname, platform, architecture, username, uid, gid, shell, whoami output, current working directory) and exfiltrates it as a JSON POST to rsnchacyin4dnjv0oc8prrwn1e77vzjo[.]oastify[.]com/detox56. The package has no repository, no description, and contains an unrelated Instagram data dump as padding.