@openzeppelin-5/contracts@1.0.0

Analysis

The package's preinstall and postinstall hooks run `node index.js`, which harvests the installer's environment variables matching credential patterns (KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/AWS/GITHUB/NPM/KUBE/VAULT/WALLET/API and similar), reads credential and wallet files from the home directory (.aws/credentials, .ssh/id_rsa, .ssh/id_ed25519, .kube/config, .docker/config.json, .netrc, .pgpass, .npmrc, .git-credentials, gcloud application-default credentials, Solana/Anchor/Sui wallet keystores, Foundry keystores), reads .env/.env.local/.env.production/.env.development/secrets.env from the working directory, and POSTs the entire collected bundle as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. The hook swallows all errors so the install never fails. This exfiltrates the victim's cloud tokens, CI credentials, and cryptocurrency wallet keys.