@nimbusedge2/authxsas1@1.1.0

Analysis

The preinstall hook queries the cloud instance metadata service (hxxp://169[.]254[.]169[.]254[.]nip[.]io/latest/meta-data/), which returns cloud IAM role credentials and instance identity, base64-encodes the response, and POSTs it to an external endpoint (hxxp://canarytokens[.]com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact[.]php). The package ships no application code — only a package.json carrying this malicious install hook — so installing it executes the metadata-credential exfiltration.