@convera/ui-shared@0.0.3

On `npm install`, the package's `preinstall.js` collects `os.hostname()` and `os.userInfo().username` and sends them as query parameters (`/?hn=<hostname>&un=<username>`) via `https.request` to `am0f14nl6o1nqwrngbrq33amfdl496xv.oastify.com`, a Burp Collaborator subdomain. The package ships an empty `index.js` (`module.exports = {}`) and a `package.json` description identifying itself as a 'bug-bounty research placeholder — Convera', published under the `@convera/*` scope to match a private internal namespace. Any installer who resolves this name (accidental scope resolution, misconfigured registry, or a legitimate Convera dev pulling the public registry version) silently leaks host identifiers to a third-party Collaborator endpoint with no opt-in and no functional code in return. Regardless of the author's stated research intent, this is unauthorized data collection from every installer and a dependency-confusion attack surface against the Convera organization. ## Source: ossf-package-analysis (647502d33492bf942a8b0bd468f7420ebca797820c7a47ac74c238c35ae08bff) The OpenSSF Package Analysis project identified '@convera/ui-shared' @ 0.0.2 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.