ohcm-culture-formatting@5.0.0

Analysis

On npm install, the preinstall hook runs index.js which uses child_process.exec to curl system files (/etc/passwd, /etc/shadow, /etc/hosts) and identity (whoami, hostname) base64-encoded to the C2 endpoint d98fu4tmls2g936th9qgfxje1qj9g91a6[.]oast[.]fun. The package also depends on noderedacteddk, a known malicious package.