relativity-pdfjs-dist@5.8.2

Analysis

Combosquat of the legitimate pdfjs-dist package. The package ships only a package.json with a preinstall hook that reads /etc/hostname and the machine's hostname, then POSTs them to the interactsh callback domain ecum3hc8xjtfd0hg9vcq7zekobu2i16q[.]oastify[.]com via curl. On install, the victim's host identity is exfiltrated to an attacker-controlled server. No other code is shipped.