ckcc-protocol@1.0.2

Analysis

The postinstall hook (postinstall.js) runs on install and exfiltrates the victim's credentials. It reads ~/.env, ~/.env.local, ~/.env.production, ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json and ~/.ethereum/keystore, then recursively scans every dot-directory in the home folder for files matching wallet|key|secret|seed|mnemonic|keystore|private or ending in .json/.pem (under 50KB). It bundles these file contents together with the hostname and username and POSTs them as JSON to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4.