camelot-ammv2-periphery@1.0.0

Analysis

The package's preinstall and postinstall hooks both execute index.js, which harvests the installer's credentials and exfiltrates them. It collects every environment variable whose name matches KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/RPC/AWS/GITHUB/NPM/KUBE/VAULT/AUTH/PGP/GPG/SEED/WALLET, reads the contents of ~/.npmrc and ~/.gitconfig, and lists the directories ~/.ssh, ~/.foundry/keystores, ~/.config/hardhat, and ~/.config/gcloud, along with hostname, username, cwd, and platform. All collected data is POSTed as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. The hooks swallow all errors so installation never fails.