trezor-lib@1.0.2

Analysis

The postinstall hook (postinstall.js) harvests credentials and exfiltrates them. On install it reads the victim's .env, .env.local, .env.production, .npmrc, .aws/credentials, SSH private keys (.ssh/id_rsa, id_ed25519, id_ecdsa), Solana wallet (.config/solana/id.json) and Ethereum keystore (.ethereum/keystore), then recursively scans all hidden directories in the home folder for files matching wallet/key/secret/seed/mnemonic/keystore/private or ending in .json/.pem. All collected file contents, along with the hostname and username, are POSTed as JSON to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The package name impersonates the Trezor hardware-wallet brand.