@dbbhk/ui-components@99.0.0

Analysis

The package @dbbhk/ui-components (version 99.0.0) impersonates an internal HSBC UI-components package and runs a credential-harvesting payload in both its preinstall and postinstall hooks (node callback.js). The payload reads AWS IMDS metadata and IAM role credentials from 169[.]254[.]169[.]254, ECS task-role credentials from 169[.]254[.]170[.]2, environment variables matching AWS/SECRET/KEY/TOKEN/PASSWORD/CREDENTIAL/AUTH/API/NPM/GITHUB/GITLAB patterns, and credential files including ~/.aws/credentials, ~/.npmrc, /root/.aws/credentials, .env, and the Kubernetes service-account token. It then POSTs the harvested host metadata and credential values (truncated to their first 8-10 characters) to a Telegram bot at api[.]telegram[.]org.