relativity-foundation-core@6.8.2

Analysis

relativity-foundation-core@6.8.2 is a trojanized package with no functional code (empty index.js). Its preinstall hook runs an inline Node.js script that collects system and CI/CD environment metadata — hostname, username, current working directory, npm registry URL, CI platform indicators, GITHUB_REPOSITORY, JENKINS_URL, and OS platform — base64-encodes the JSON payload, and exfiltrates it via an HTTPS GET request to aiwi9di43fzbjwncfrimdvkgu701orcg[.]oastify[.]com (an interact.sh-style OAST callback service). The exfiltrated data allows the attacker to identify high-value CI/CD build environments for follow-on compromise.