orderly-plugin-liquidity-heatmap@1.0.0

Analysis

The package ships a postinstall hook (scripts/setup.js, run as `node ./scripts/setup.js`) that performs CI-runner reconnaissance and attempts to mint a GitHub Actions OIDC token. The advertised plugin is an empty stub — dist/index.js is 72 bytes and registerLiquidityHeatmapPlugin() returns a no-op — while the install hook does the real work. The hook is gated on `process.env.CI && process.env.GITHUB_WORKSPACE`: on any non-CI machine it prints a benign "local environment detected, skipping setup cache" message and exits 0, so it stays dormant outside a GitHub Actions runner and only executes in CI. When the gate passes it collects: hostname, OS type/release, username, working directory, GITHUB_REPOSITORY, GITHUB_WORKFLOW, RUNNER_ENV, ImageOS, and the sorted list of every environment variable name beginning with GITHUB_, ACTIONS_ or RUNNER_. It records whether GITHUB_TOKEN is set and its length, whether ACTIONS_ID_TOKEN_REQUEST_TOKEN is present, and the ACTIONS_ID_TOKEN_REQUEST_URL. It runs `npm config get registry`, probes outbound connectivity with curl to registry[.]npmjs[.]org, api[.]github[.]com, github[.]com and objects[.]githubusercontent[.]com (recording HTTP status codes), and enumerates versions of git, node, npm, yarn, python3, docker and gh. It then requests a GitHub Actions OIDC token by calling the runner's ACTIONS_ID_TOKEN_REQUEST_URL with `Authorization: Bearer <ACTIONS_ID_TOKEN_REQUEST_TOKEN>` and `audience=api[.]github[.]com`, recording the HTTP status. The collected snapshot is written to `heatmap-setup-report.json` in the GITHUB_WORKSPACE checkout, placing the runner fingerprint and token-mint result inside the repository workspace where a later workflow step can read it. No outbound exfiltration endpoint is present in this version: the snapshot is staged to the workspace file rather than transmitted, and the OIDC response body is discarded. The behaviour is install-time host/CI fingerprinting plus an OIDC token-mint attempt, hidden from non-CI environments.