content-publisher-sdks@1.0.1

Analysis

The package runs a preinstall hook (node index.js) that collects system information — hostname, home directory, username, DNS server addresses, /etc/passwd contents, and /etc/hosts contents — and POSTs the data as JSON to ie02j5ztgjeb6i7tp467ydwnjep8dy1n[.]oastify[.]com (a Burp Collaborator endpoint). The data is exfiltrated at install time before the package is usable for any legitimate purpose.