amdocs-auth-package@114.2.1

Analysis

The package runs a preinstall hook (node index.js) that collects detailed system information — hostname, platform, architecture, username, UID, GID, shell, OS type, release, total/free memory, CPU count, current working directory, and the output of the `whoami` and `id` commands — and POSTs it as JSON to hxxps://qjdzxvqs71bk5m4tr1ij26439ufl3br0[.]oastify[.]com/detox56. The package name combosquats the legitimate Amdocs brand. No token or credential theft was observed; the payload is a system-reconnaissance beacon.