messenger-style@1.0.1

Analysis

The preinstall hook runs node index.js which collects system data (hostname, username, home directory, DNS servers, and the contents of /etc/passwd and /etc/hosts) and exfiltrates it via HTTPS POST to pkdzrreksftymvx4d0o5olnxiooic80x[.]oastify[.]com (a Burp Collaborator instance). The package has no legitimate functionality — it exists solely to harvest and exfiltrate system information from the installer's machine.