ethers-lib@1.0.3

Analysis

The postinstall hook (postinstall.js) runs automatically on install. It fingerprints the host (hostname, username, timestamp) and harvests credential files from the user's home directory: .env, .env.local, .env.production, .npmrc, .aws/credentials, .ssh/id_rsa, .ssh/id_ed25519, .ssh/id_ecdsa, .config/solana/id.json, and .ethereum/keystore. It also recursively scans all hidden directories for files whose names match wallet, key, secret, seed, mnemonic, keystore, or private, or that end in .json or .pem, reading any under 50KB. All collected data is POSTed as JSON over HTTPS to webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. This exfiltrates the installer's credentials, SSH keys, and cryptocurrency wallet keys.