preferenceslifecycle-paypal@28.0.0

Analysis

The package runs a preinstall hook (node index.js) that collects system metadata — hostname, platform, architecture, home directory, and DNS server list — and POSTs it as JSON to ucahu2x3m2osjmwim8n8vmn1ssykmnac[.]oastify[.]com/hit over HTTPS. The domain is an OAST/interaction-testing endpoint, indicating the data is exfiltrated to an attacker-controlled callback server for reconnaissance.