@ts-expect-error/n@99.9.9

Analysis

@ts-expect-error/n@99.9.9 is a credential-stealing package published under a scoped name at the sentinel version 99.9.9 with a 2.7 KB tarball, and it lists itself in its own dependencies. Its package.json declares a postinstall hook that runs `node poc.js`. That script collects the installer's system and account data — os.userInfo(), os.hostname(), os.platform(), os.arch(), os.release(), os.networkInterfaces(), the install path, and the entire process.env — serializes it to JSON, and sends it with an HTTP POST to the hardcoded address hxxp://31[.]56[.]206[.]17:8443/ts-expect-error. The captured request body contains the installer's environment, including npm, GitHub, GitLab, AWS, OpenAI, Anthropic, Stripe, Slack, SendGrid, DigitalOcean, Cloudflare, Hugging Face and PyPI credentials and CI job metadata. Network and request errors are swallowed so the install completes silently. The package describes itself as a "Security Research Package" with bug-bounty keywords, but its behaviour is exfiltration of the installing environment's secrets. IOCs: C2 hxxp://31[.]56[.]206[.]17:8443/ts-expect-error (POST, JSON), host 31[.]56[.]206[.]17 port 8443, hook file poc.js.