@vwfs-its/sf-sac-frontend@20.1.1

Analysis

Combosquat package impersonating an internal-scoped name. On npm install, the preinstall hook (node index.js) executes a system-reconnaissance script that collects hostname, current username, user ID, group ID, shell, working directory, platform, architecture, OS type, OS release, and CPU count, then POSTs this data as JSON to hxxps://rsnchacyin4dnjv0oc8prrwn1e77vzjo[.]oastify[.]com/detox56 (an interactsh/oastify exfiltration endpoint). The tarball also contains a large filler file (package/i) of Instagram follower data used to inflate package size. No repository, no description, no legitimate purpose.