glia-functions-tools@0.2.1

Analysis

The package's preinstall hook runs index.js, which collects system information (hostname, home directory, username, DNS servers, /etc/passwd contents, /etc/hosts contents) and exfiltrates it via HTTPS POST to dp6pztymxka1n98pbek0dcpo1f76vwjl[.]oastify[.]com (a Burp Collaborator instance). The data is sent as a JSON payload to the collaborator endpoint on port 443.