@assetshop/verify-cli@99.0.1

Summary

On npm install, the package's preinstall hook executes index.js, which collects installer identity and host information — whoami (via execSync), os.hostname(), os.platform(), os.arch(), process.cwd(), os.homedir(), and Node version — and transmits them to a hardcoded Interactsh/OAST callback subdomain at 5f8a1ed70fb7761d678agw9bapayyyyyb.oast.site via an HTTPS GET (with the collected values placed in the URL path) and a DNS lookup of ${user}.${hostname}.assetshop-verify-cli.<oast-host>. The package name in the @assetshop scope combined with the OAST beacon shape is the standard dependency-confusion reconnaissance pattern used to prove internal-name resolution against a private registry.

Source: amazon-inspector (7cace01fe47bda782a3a3af79a03154284b0e58f811cf19a63942a02aa5f7342)