cloudsmith-vsc@2.1.2

package.json declares a preinstall hook (`"preinstall": "node index.js"`) that runs automatically on `npm install`. index.js reads installer-side system identity and files — `os.hostname()`, `os.userInfo()`, homedir, DNS configuration, package metadata, `/etc/passwd`, and `/etc/hosts` — and POSTs them over HTTPS to a hardcoded Burp Collaborator subdomain (`6hoa7n94q5v6yig1hqokwg6f066zupie.oastify.com`). The package metadata is empty (no description, author, or license) and the name impersonates the Cloudsmith vendor brand, consistent with a dependency-confusion / typosquat recon-and-exfil payload. Any machine that installs this package transmits host fingerprinting and local account data to the attacker.