test_adminet@99.9.9

Analysis

test_adminet@99.9.9 runs a preinstall hook that executes `node index.js`, which uses child_process.exec to send a curl request to webhook[.]site/d5968c3d-d0d7-46c4-9305-a726b24fce9c/test_adminest/$(whoami)/$(hostname)/. The User-Agent header contains base64-encoded contents of /etc/passwd, /etc/hosts, the output of `id`, and /etc/shadow (if readable). This exfiltrates system identity and sensitive files to a webhook[.]site endpoint on install.