@offa-uwk/offa-uwk@999.0.6

Analysis

Dependency-confusion stub (scoped name @offa-uwk/offa-uwk, version 999.0.6) with a postinstall hook that runs index.js. The script collects the hostname, username, current working directory, and timestamp, then POSTs this metadata as JSON to webhook[.]site/e6b10849-38dc-4280-a8e3-72ab39cfaf65. After exfiltration, it executes shutdown -h now (or systemctl poweroff as fallback) to halt the system. A preinstall hook also writes a marker file to /home/OFFA/flag. The package has no repository, no meaningful description, and ships only a 1.5KB index.js.