Malicious code in technical-challenge (npm)

__

Source: amazon-inspector (6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f)

package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer-side data — hostname, username, home directory, DNS server list, current working directory, package.json contents, and the contents of /etc/passwd and /etc/hosts — and HTTPS-POSTs it to a hardcoded Burp Collaborator subdomain at 5z5h9l8e7cktx1ihl6usn4zgb7h15rtg.oastify.com. The exfiltration fires unconditionally on install with no user interaction.