Note: This report is updated by a verification record
Malware detected: Exfiltrates sensitive data (hostname, platform, username, IP, env vars) to webhook.site via postinstall script.
The package is marked as malware by OSV: MAL-2025-6387 with source: reversing-labs
Note: This report is updated by a verification record
The package is a malware because it contains a postinstall script that executes index.js. The index.js script gathers sensitive information such as hostname, platform, username, IP address, and environment variables and sends it to an external server (webhook.site) via an HTTPS POST request. This constitutes data exfiltration and is a clear indicator of malicious behavior.
