autbank-core@99.0.0

Analysis

The preinstall hook (preinstall.js) collects host identity (hostname, platform, architecture, username, home directory, working directory, node version) and harvests environment variables whose names contain KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIALS, AUTH, or PRIVATE, plus the contents of any .env file and the output of `git remote -v`. It POSTs this data as JSON to 209[.]99[.]185[.]109:8888/npm-exfil, and as a backup encodes the hostname as hex and resolves it as a DNS subdomain of 209[.]99[.]185[.]109. The postinstall hook references a postinstall.js file that is not present in the package.