siriusbeyond@1.0.0

Analysis

The package runs a callback script in both its preinstall and postinstall hooks. The script fingerprints the host (hostname, username, platform, working directory, home directory, network IP addresses, process UID/GID/PID), detects the CI/CD environment and cloud provider, enumerates the names of sensitive environment variables (matching token/secret/key/password patterns), and checks for the presence of credential files (.env, .npmrc, .git/config, .docker/config.json). It POSTs the collected data to the Telegram Bot API (api[.]telegram[.]org) using a hardcoded bot token and chat ID, and attempts DNS-based exfiltration to dc-callback[.]example[.]com as a backup channel.