notafollower@1.0.0

Analysis

The package contains no functional code; its postinstall hook runs an inline Node script that collects the host platform, hostname, username, and the full process environment (all environment variables, including CI/CD tokens such as GITHUB_TOKEN, NPM_TOKEN, NODE_AUTH_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, STRIPE_SECRET_KEY, SLACK_TOKEN, TWILIO_AUTH_TOKEN, SENDGRID_API_KEY, DIGITALOCEAN_TOKEN, CLOUDFLARE_API_TOKEN, NETLIFY_AUTH_TOKEN, HF_TOKEN, PYPI_TOKEN, GITLAB_TOKEN, CI_JOB_TOKEN, DOCKER_PASSWORD, CARGO_REGISTRY_TOKEN) and POSTs them as JSON to hxxps://mourner-slot-explicit[.]ngrok-free[.]dev/?cross_os_cloud=1. It additionally fetches the GitHub Actions OIDC token (ACTIONS_ID_TOKEN_REQUEST_URL) and includes it in the exfil. Credential theft occurs at install time via a remote tunnel endpoint.