osep-api-hub-service-client-v1

package.json declares `"preinstall": "node index.js"`, causing index.js to run automatically on `npm install`. index.js collects host identifiers — `os.hostname()`, `os.userInfo()` (username/uid/gid/shell), `os.homedir()`, `process.platform`, `process.arch`, `process.cwd()` — and additionally shells out via `child_process` to `whoami` and `id`. The collected JSON is POSTed to the hardcoded URL `https://0pqbxi1hplohnif3fa7tyc1at1zsnobd.oastify.com/detox56`, a Burp Collaborator (oastify.com) subdomain controlled by whoever published the package. The package name mimics an internal-sounding scoped client and ships with empty author/description metadata, consistent with a dependency-confusion attack targeting a private package namespace. Any developer or CI system that installs this package immediately leaks host and user identity to the attacker's Collaborator endpoint.