meualelo@99.0.2

Analysis

The package runs two install lifecycle hooks (preinstall.js and index.js) that harvest the installer's environment and credentials and exfiltrate them to a remote host. preinstall.js serializes the full process.env (including GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, STRIPE_SECRET_KEY, SLACK_TOKEN, ANTHROPIC_API_KEY and other CI/cloud tokens) and POSTs it as JSON to hxxps://alelo1786663101[.]requestcatcher[.]com/preinstall. index.js additionally reads the contents of .env, .npmrc, ../.env and ../../.env (first 5000 characters of each) and runs `whoami`, then POSTs the collected data to hxxps://alelo1786663101[.]requestcatcher[.]com/postinstall. Both exfiltrations occur over HTTPS on port 443. The package also ships login.ps1, a PowerShell script.