permit2@1.0.0

Analysis

The package runs a credential-harvesting payload from both its preinstall and postinstall hooks (`node index.js`). On install it collects every environment variable whose name contains KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/RPC/AWS/GITHUB/NPM/KUBE/VAULT/AUTH/SEED/WALLET/BEARER/API/INFURA/ALCHEMY/HELIUS/QUICKNODE/ANKR, and reads a wide set of credential files from the user's home directory and working directory, including ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.pgpass, ~/.npmrc, ~/.pypirc, ~/.git-credentials, Google Cloud application-default credentials, Solana/Anchor/Sui/Near/Foundry keystores, and .env files. It then POSTs all harvested data as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09, along with the hostname, username, cwd, and platform. Errors are silently swallowed so the install always succeeds.