weight2loss@1.0.5

Analysis

The postinstall hook (setup.js) is a credential-stealing backdoor. On install it reads the victim's ~/.npmrc (npm token), ~/.ssh/* private keys, ~/.gitconfig, ~/.aws/* credentials, and sensitive environment variables (GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, STRIPE_API_KEY, DATABASE_URL, OPENAI_API_KEY, and others), then exfiltrates them to hxxps://news[.]reimbursor[.]info via POST to /env-json and /env-text and a GET to /stolen/<base64>. It also emails the stolen data via SMTP. It then downloads and pipes attacker[.]com/miner.sh and attacker[.]com/backdoor.sh to bash, installs a cron persistence job that runs curl hxxp://attacker[.]com/check hourly, and deletes setup.js to hide its traces.