Malicious code in messenger-style (npm)

__

Source: amazon-inspector (48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10)

The package's preinstall hook runs node index.js, which collects host identifiers (os.hostname(), os.userInfo().username, home directory, DNS servers) and reads /etc/passwd and /etc/hosts from the installer's machine, then POSTs the collected data over HTTPS to the hardcoded host pkdzrreksftymvx4d0o5olnxiooic80x.oastify.com (a Burp Collaborator out-of-band interaction domain). The package name suggests a messaging utility, but no such functionality is present — the sole behavior on npm install is host reconnaissance and exfiltration to an attacker-controlled OAST endpoint.