@evial/runtime-health@1.0.0

Analysis

The postinstall hook executes a charcode-obfuscated bootstrap appended to a vendored lodash. On install it harvests cloud credentials from ~/.aws/credentials, ~/.aliyun/config.json, ~/.cos_credential, ~/.baidubce/credentials, ~/.ossutilconfig, ~/.docker/config.json, ~/.kube/config and ~/.npmrc, dumps the full environment and `id` output, and probes cloud metadata endpoints 169[.]254[.]169[.]254, 100[.]100[.]100[.]200, metadata[.]tencentyun[.]com and 169[.]254[.]80[.]80. The collected data is written to rt-probe.log and sysinfo.log in the package directory, /workspace, and parent directories.