airkey-mfa-react@20.0.1

package.json declares a preinstall hook that runs index.js on `npm install`. index.js collects host and user identity data — hostname, platform, arch, home directory, username/uid/gid/shell, OS info, cwd, plus the output of `whoami` and `id` — and POSTs the JSON to a hardcoded Burp Collaborator-style OAST subdomain at s70v1tcmg3npuykzzok5t0tdz45vtlha.oastify.com/detox56. The package ships no library code matching its advertised MFA/React purpose; the install-time beacon is the package's only functional behavior. Empty author/description metadata and the mismatch between the package name and its contents are consistent with a dependency-confusion or namespace-squat placeholder targeting an internal package name. ## Source: ossf-package-analysis (aabfcc531d8f0174d9ba67b4ff82625500d953dfa0016b3e7bd95df973d5509f) The OpenSSF Package Analysis project identified 'airkey-mfa-react' @ 36.1.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.