The 'strapi-plugin-vinsoc-1109' package at version 3.6.8 includes a postinstall lifecycle script that runs automatically on npm install. This script reads the local machine's hostname, sanitizes it, and embeds it as a subdomain in a hardcoded attacker-controlled domain (1bdtwmd0wdrpwnlput1up9x39ufl3br0.oastify.com). It then performs DNS and HTTP GET requests to this domain, effectively exfiltrating the installer's machine identifier silently. The package does not provide any legitimate plugin functionality and is identified as malicious by the OpenSSF Package Analysis project due to its communication with a domain linked to malicious activity.

The impact is the silent exfiltration of the hostname of any machine that installs this package version, potentially enabling attacker reconnaissance or further targeted attacks. No direct exploitation or code execution beyond this data leakage is described. The package masquerades as a Strapi plugin but performs no legitimate functions.

No official patch or remediation is indicated. Users should avoid installing 'strapi-plugin-vinsoc-1109' version 3.6.8. Remove the package if already installed and verify dependencies to ensure no indirect inclusion. Monitor for any updates from the package maintainers or npm advisories for further guidance.