osep-react-antd

package.json declares `preinstall: node index.js`, which runs automatically on `npm install`. index.js collects host identifiers (os.hostname(), process.platform, arch, os.homedir(), os.userInfo() including uid/gid/username/shell, cwd) and the output of `whoami` and `id` via child_process, then POSTs the JSON payload to a hardcoded URL `https://qtn11857tbs7r8jtj0bj2250xr3jrafz.oastify.com/detox56`. The oastify.com host is Burp Suite Collaborator out-of-band infrastructure used to receive callbacks from compromised installers. The package name mimics React/Ant Design naming conventions and ships empty author/description/license metadata with no functional code beyond the beacon — the dependency-confusion squat shape. Installer harm: every `npm install` of this package leaks the installer's hostname, username, uid/gid, and shell to the attacker, identifying internal corporate environments and CI runners for follow-on targeting.