merchantprefsservice-paypal@28.0.0

Analysis

Dependency-confusion package (name mimics an internal PayPal service name) runs a preinstall hook that exfiltrates system metadata to a remote C2 server. On install, index.js collects hostname, platform, architecture, home directory, and DNS server list, then POSTs the data as JSON to fdw2vnyonnpdk7x3ntotw7omtdz5n4bt[.]oastify[.]com:443/hit over HTTPS. The package has no repository and no legitimate functionality beyond this beacon.