cma-self-hosted-sandbox-cf@1.0.0

package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home directory, configured DNS servers, and the contents of /etc/passwd and /etc/hosts, then HTTPS POSTs the JSON payload to the hardcoded Burp Collaborator subdomain 49bl3t5yt786ymbtth24nnlbs2ytmka9.oastify.com. The behavior fires automatically on install with no user interaction, the destination is an attacker-controlled out-of-band interaction host unrelated to any legitimate package function, and the collected data comprises installer-side system identifiers and local account/host files. This is a dependency-confusion/recon exfiltration payload with no other functionality present in the package.