colorpicker-ui@1.2.6

Analysis

The postinstall hook (setup.js) of this "React color picker" package runs a reconnaissance and exfiltration implant on install. It collects host identity (hostname, user, kernel, machine-id, capabilities, seccomp), performs sandbox detection, and harvests cloud credentials from AWS EC2 metadata (IMDSv1 and IMDSv2 IAM role security credentials), GCP metadata (service-account token), and Azure metadata (identity token), plus any Kubernetes service-account token. It enumerates network interfaces, routes, and listening ports, port-scans localhost, the gateway, and the first 20 subnet IPs, and probes processes, filesystem, sudo/cron/capabilities for privilege escalation. All collected data is POSTed in chunks to hxxps://webhook[.]site/3dc365ff-07dd-42e6-b5e7-e707736401fb.