@iana-rzms/bff-sdk@1.0.0

Analysis

The package's preinstall hook beacons hostname, OS username, and current working directory to an attacker-controlled Burp Collaborator host (k4pzh6vg78iub3vxqhmml2q8wz2qqge5[.]oastify[.]com) via HTTPS on port 443, HTTP on port 80, and a DNS lookup. This confirms that a build resolved the package from the public npm registry, exfiltrating build-environment identity to an external host. The package has no repository, no verifiable purpose, and the beacon is the only functionality.