@ks-radar/radar@21.0.0

Analysis

The package runs a preinstall script that reads a hex-encoded command from a bundled JSON file, decodes it, and executes it. The decoded command uses curl to POST system information (whoami, current working directory, hostname) and the contents of /etc/passwd to a remote webhook endpoint at eobdzec83knbura[.]m[.]pipedream[.]net. This is a system-reconnaissance and data-exfiltration payload that runs at install time without the user's knowledge.