cr-bot-common@1.0.0

Analysis

cr-bot-common@1.0.0 ships preinstall and postinstall hooks that harvest secrets and exfiltrate them to a remote host. On install, preinstall.js and postinstall.js collect system information (hostname, platform, user, cwd, node/npm versions), read .env files (including ../.env, /app/.env, /opt/.env), read config/database/wallet/keys/secrets/credentials files, search the home directory and /root,/home,/opt,/app,/var/lib for private-key, wallet, keystore, and mnemonic files, and harvest environment variables whose names match KEY, SECRET, TOKEN, PASSWORD, DATABASE, AWS, PRIVATE, JWT, SESSION, ENCRYPTION, MONGO, POSTGRES, MYSQL, or TON. The collected data is POSTed as JSON to attacker[.]com/collect and attacker[.]com/exfiltrate. The package is presented as a CryptoBot TON wallet integration.