@umschool/platform@999.0.0

Analysis

The postinstall hook (postinstall.js) of @umschool/platform@999.0.0 is a credential harvester. On install it reads the Kubernetes service-account token, namespace, and CA from /var/run/secrets/kubernetes[.]io/serviceaccount/, fetches AWS and Yandex cloud metadata credentials from the 169[.]254[.]169[.]254 metadata endpoints (IAM security-credentials and computeMetadata token paths), enumerates the full process environment for variables matching token/secret/key/pass/auth/db/url/host/api/aws/yc/k8s/kube, reads .env files up five directory levels, reads /etc/hosts and /etc/resolv.conf, and queries the Kubernetes API using the stolen service-account token. All collected data is base64-encoded and POSTed to the callback host akko[.]requestcatcher[.]com over HTTPS with certificate verification disabled. The package self-describes as a dependency-confusion proof-of-concept but actually exfiltrates credentials, tokens, environment variables, and files.