@alleata/types@0.3.1

Analysis

The package masquerades as TypeScript type definitions but ships a postinstall credential harvester (.prepare.cjs). It first runs extensive anti-analysis evasion (sandbox/VM checks on hostname and usernames, CI detection, profiler and mock-CA-path checks) and delays execution 15-45 seconds via setTimeout, then collects the entire process environment (harvesting secrets such as NPM_TOKEN, GITHUB_TOKEN, and AWS keys) plus host metadata and exfiltrates them via HTTPS POST to an attacker-controlled Lark webhook at open[.]larksuite[.]com, with the destination host decoded via reverse+subtract-7 and the path XOR-encoded.