array-sort-helper@1.0.0

Analysis

The package array-sort-helper@1.0.0 is a trojanized utility that runs a system-reconnaissance payload in its postinstall hook (postinstall.js). On install, it collects hostname, username, OS/kernel details, container/Docker status, process tree, CI/CD environment variables (GITHUB_REPOSITORY, GITHUB_ACTOR, GITHUB_RUN_ID, CI, RUNNER_NAME), IP addresses, DNS configuration, and probes cloud metadata endpoints (Tencent Cloud and AWS). All collected data is base64-encoded and exfiltrated via HTTP GET to pzs5w7ntzhsnepwk564lyfdci3oucl0a[.]oastify[.]com/z?d=<data>. The package contains no actual sorting or grouping functionality — the entire payload is reconnaissance and beaconing.