qlkube@1.0.0

Analysis

qlkube@1.0.0 is a supply-chain trojan with no legitimate functionality. On npm install, its preinstall hook executes a curl command that beacons to an OAST callback endpoint at cwcie03pzedo62twgbs3x6e9l0rsfk39[.]oastify[.]com. The package's only code is a trivial "Hello from test package!" console.log, and it has no repository, description, or other purpose. The oastify[.]com domain is a known interaction-tracking service used to detect when a package is installed in a target environment.