coin-fees@20.1.1

Analysis

coin-fees@20.1.1 is a trojanized package masquerading as an esbuild platform build. Its postinstall hook runs index.js, which waits 30-120 seconds then exfiltrates host information (hostname, platform, architecture, current working directory, package.json), the full process environment, and the user's ~/.npmrc file to the C2 host gvfvq5cm9r9jfs3d6mzp7y8pbkz7[.]oastify[.]com on port 80 via HTTP POST. It also runs whoami, id, uname -a, npm root -g, ver, and tasklist, and scans localhost ports 80/443/3000/5000/8080/8443/9090, reporting open ports. The script suppresses all errors and exits silently when CI/audit environment variables are detected to evade analysis.