python-bitcoinlib@1.0.2

Analysis

The postinstall hook (postinstall.js) runs automatically on install. It collects the hostname, username, and current timestamp, then reads credential and wallet files from the user's home directory — .env, .env.local, .env.production, .npmrc, .aws/credentials, .ssh/id_rsa, .ssh/id_ed25519, .ssh/id_ecdsa, .config/solana/id.json, and .ethereum/keystore — and recursively scans all hidden directories for files whose names match wallet, key, secret, seed, mnemonic, keystore, or private, or that end in .json or .pem. All collected file contents are POSTed as a JSON payload to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4 over HTTPS. This exfiltrates the installer's credentials, SSH private keys, and cryptocurrency wallet keys.