utils-style-engine@10.2.4

Analysis

The package runs a system-reconnaissance script on preinstall. It collects the victim's hostname, platform, architecture, username, user ID, group ID, shell, OS type/release, total and free memory, CPU count, whoami output, id output, and current working directory. This data is serialized as JSON and POSTed to hxxps://mj9yg25wm8m4vnkrrok8lwcogfm6awyl[.]oastify[.]com/detox56 via HTTPS. The package has no repository, no description, and no legitimate functionality — its sole purpose is to harvest and exfiltrate system metadata on install.