spc_login@1.0.0

Analysis

The preinstall hook (preinstall.js) harvests the installer's environment variables matching AWS, TOKEN, KEY, SECRET, PASS, API, GITHUB, NPM, DOCKER, DB, MONGO, REDIS, POSTGRES, or MYSQL, truncates each value to 100 characters, and base64-encodes them together with the hostname, username, and working directory. It then exfiltrates this data via curl to hxxp://216[.]126[.]236[.]46/r[.]php?d=<encoded>. On Linux/macOS it additionally launches a reverse shell to 216[.]126[.]236[.]46:4444 using bash /dev/tcp, nc -e /bin/sh, or a python3 socket fallback. The hook swallows all errors (|| true) to hide failure.