tracker-radar-detector@1.0.1

Analysis

The preinstall hook (node index.js) collects system information from the installer's machine — hostname, home directory, username, DNS server addresses, /etc/passwd, /etc/hosts, and the package.json contents — and exfiltrates them via HTTPS POST to mka6p95xmnkfcmdxv8cb4h2rpivej47t[.]oastify[.]com (a Burp Collaborator instance). The package name is a decoy: it presents itself as a tracker-detection tool but performs the exfiltration itself.