The 'tool-registry-scripts' npm package version 1.0.0 declares a preinstall hook in its package.json that executes index.js upon 'npm install'. This script gathers host identifiers such as os.hostname(), user information, home directory, DNS servers, current working directory, and package.json contents. It also reads sensitive system files /etc/passwd and /etc/hosts. The collected data is serialized into JSON and sent over HTTPS to a hardcoded Burp Collaborator out-of-band endpoint (lsh5x8dwumsekllw37kacgaqxh3cr2fr.oastify.com), which is unrelated to any documented package purpose. This behavior constitutes malicious exfiltration of sensitive host data triggered automatically during installation.

Sensitive host information and system file contents are exfiltrated to an attacker-controlled server without user consent. This can lead to information disclosure and potential further compromise depending on the environment where the package is installed. The automatic execution at install time increases risk as users may be unaware of the data leakage.

No official patch or remediation is documented for this package version. Users should avoid installing 'tool-registry-scripts' version 1.0.0. Remove any installations of this package and audit systems for potential data exposure. Monitor for suspicious network connections to the indicated domain. Since this is a malicious package, rely on trusted sources and package registries to avoid similar threats.