@nstrlabs/shared-componentsnpm

On npm install, the package's preinstall script runs index.js, which collects host identifiers (os.hostname(), os.userInfo().username, __dirname, process.cwd(), package name) and ships them to two attacker-controlled destinations: (1) a hex-encoded DNS subdomain query against *.d8jbmnsqcfu78dfs8vdg34ohqhirb4pbg.oast.live (Interactsh-style out-of-band exfiltration), and (2) an HTTP POST of the same JSON payload to bare IP http://172.201.213.59:9090/c. The package is published under @nstrlabs/shared-components at version 99.0.0 with description security research — a high semver against a generic scoped name consistent with a dependency-confusion attack targeting an internal nstrlabs namespace. There is no legitimate library functionality; the preinstall beacon is the package's only effect.