order-package-saas@999.0.0

Analysis

The postinstall hook executes a credential-harvesting payload. After a randomized 5-15 second delay, it reads a broad set of victim credentials from disk — ~/.npmrc, ~/.yarnrc, ~/.git-credentials, SSH private keys, ~/.aws/credentials and AWS SSO cache, gcloud application_default_credentials.json, Azure accessTokens.json, ~/.kube/config, ~/.docker/config.json, Terraform credentials, GitHub CLI hosts.yml, ~/.netrc, Vercel/Netlify/Supabase/Firebase auth files, ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, VSCode settings, and gem/pypi/cargo credentials — and harvests every environment variable whose name contains TOKEN, KEY, SECRET, PASSWORD, API, AUTH, CREDENTIAL, or similar. The collected data is base64-encoded and exfiltrated to a hardcoded Telegram bot (via sendMessage/sendDocument to a fixed chat_id) and also POSTed to hxxp://2[.]26[.]82[.]63:8888/collect. The payload skips execution when NODE_ENV=test, CI=true, JEST_WORKER_ID, VITEST, or /.dockerenv is present.