@evial/runtime-utils@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs system-recon commands (id, whoami, hostname, pwd, uname -a) and then dumps the full process environment, including credential-bearing variables and their values, into a log file written to the workspace root and /workspace/runtime-snapshot.log. The package's main module is an inert stub exporting only its name and version, so the sole executable behaviour is this environment/credential harvest. No network exfiltration endpoint is used; the collected environment is written to local log files.