@offa/offa-uwk@999.0.0

One or more suspicious static signals were detected.

npm installation executes preinstall and postinstall.

Exposure of credentials and other secrets present in installer environment variables.

lifecycle-triggered environment harvesting and HTTPS exfiltration attempt

During installation, postinstall runs index.js. It gathers hostname, username, cwd, timestamp, and the entire process environment, then attempts a POST to a webhook endpoint. The endpoint configuration is malformed, but the source plainly implements credential-capable host-data exfiltration; preinstall also writes outside the package directory.

Source directly implements automatic environment harvesting and external transmission during npm install. The malformed hostname may prevent delivery, but does not negate the concrete malicious install-time behavior.