tool-registry-scripts@1.0.0

Analysis

The package's preinstall hook (node index.js) collects system information — hostname, home directory, username, DNS server list, /etc/passwd contents, and /etc/hosts contents — and POSTs the data as JSON over HTTPS to lsh5x8dwumsekllw37kacgaqxh3cr2fr[.]oastify[.]com (a Burp Collaborator / OAST exfiltration endpoint). The exfiltration was confirmed at runtime: the install process resolved the domain, connected on port 443, and transmitted the full payload including the /etc/passwd file.