http-req-lite@1.0.0

Analysis

http-req-lite@1.0.0 is a combosquat package impersonating a simple HTTP request helper. Its postinstall hook (postinstall.js) executes two curl commands: one fetches tst[.]woa[.]com/flag.html and pipes the response as a POST body to pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com/ssrf1; the other sends a request to tst[.]woa[.]com/ssrf_forward.php?host=pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com, using the external host as an SSRF forwarder parameter. The main index.js is a trivial 67-byte fetch wrapper with no relation to the postinstall behaviour. IOCs: tst[.]woa[.]com, pwpzhsrbtvmfqrqr7onqcwnrcii960up[.]oastify[.]com, /flag.html, /ssrf_forward.php, /ssrf1.