orderly-plugin-liquidity-heatmap@1.0.4

Analysis

orderly-plugin-liquidity-heatmap ships a postinstall hook (scripts/setup.js) that harvests CI credentials and writes to the installing repository. The package presents itself as an Orderly DEX orderbook heatmap plugin (dist/index.js is a 72-byte stub), but the hook is the payload: it only proceeds when both CI and GITHUB_WORKSPACE are set, so it stays dormant on developer machines and runs only inside GitHub Actions runners. When it runs it collects hostname, OS/platform, username, working directory, GITHUB_REPOSITORY, GITHUB_WORKFLOW, RUNNER_ENV, ImageOS, the sorted names of every GITHUB_*/ACTIONS_*/RUNNER_* environment variable, whether GITHUB_TOKEN is present and its length, and whether ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN exist; it probes outbound reachability to registry[.]npmjs[.]org, api[.]github[.]com, github[.]com and objects[.]githubusercontent[.]com with curl, reads `npm config get registry`, and enumerates git/node/npm/yarn/python3/docker/gh versions. It then mints a GitHub Actions OIDC token by calling ACTIONS_ID_TOKEN_REQUEST_URL with the runner's bearer token, writes the collected snapshot to heatmap-setup-report.json in $GITHUB_WORKSPACE, appends it to $GITHUB_STEP_SUMMARY, and uses the workflow's GITHUB_TOKEN to PUT that file to the repository contents API (contents:write). Finally it configures git as github-actions[bot] and force-pushes a tag named heatmap-setup-<timestamp> to origin using the credentials actions/checkout persisted in .git/config, leaving a trace at <tmpdir>/heatmap-exec-trace.log. The README describes this only as a "small setup step" that "detects the build environment and pre-caches asset paths". No attacker-controlled C2 host is used; the endpoints touched are api[.]github[.]com, registry[.]npmjs[.]org, github[.]com and objects[.]githubusercontent[.]com, and the artifacts are heatmap-setup-report.json, heatmap-exec-trace.log and the heatmap-setup-* git tag.