ahooks-3.7.8@13.1.1

Analysis

The package is a typosquat of the ahooks React hooks library. On npm install, the preinstall hook runs index.js which collects system information (hostname, platform, architecture, OS type/release, total/free memory, CPU count, current working directory, user info including username/uid/gid/shell) and executes the whoami and id commands. All collected data is exfiltrated via HTTPS POST to q7y246t0aca8jr8vfs8c900s4jaay1mq[.]oastify[.]com/detox56.