@nimbusedge2/authxsas@1.1.0

Analysis

The package's preinstall hook runs at install time: it fetches the cloud instance metadata service (hxxp://169[.]254[.]169[.]254[.]nip[.]io/latest/meta-data/), base64-encodes the response, and POSTs it to hxxp://canarytokens[.]com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact[.]php. The cloud metadata endpoint can return IAM role credentials and instance identity data, so this exfiltrates potentially credential-bearing cloud metadata from any machine that installs the package. The package contains no other code — a single package.json whose only script is this exfiltration.