casamare@1.0.0

Analysis

casamare@1.0.0 is a trojanized SDK: the advertised Angular helper modules are a thin decoy wrapped around a 313 KB obfuscated browser payload shipped as dist/assets/5760.pbf (duplicated at src/assets/5760.pbf). The file is not a protobuf asset — it is a javascript-obfuscator bundle (rotated string table, _0x identifier decoder, base64/atob helpers) that runs immediately on load and installs itself into the page. What it does in the browser: - Reads localStorage keys for public and admin access/refresh tokens, the stored user profile, and any auth/session markers, then base64-encodes and JSON-serialises the entire localStorage and sessionStorage. - Dumps document.cookie and collects location.href, document.referrer, navigator.userAgent, and a browser snapshot (language, platform, hardware concurrency, device memory, connection type/downlink/rtt/saveData). - POSTs the assembled record — user_key, auth_signature, origin, page_url, referrer, user_agent, browser_snapshot, profile, public_access_token, public_refresh_token, admin_access_token, admin_refresh_token, cookies, raw_storage — to a remote endpoint whose URL is assembled at runtime from the obfuscated string table and sent with apikey/Authorization headers (a hosted-function style endpoint on supabase[.]co). - Re-fires the exfiltration on SPA navigation by wrapping history.pushState/replaceState, on popstate/hashchange, on a MutationObserver over the document, and on a requestAnimationFrame loop, so a fresh token captured after login is sent again. - Injects anchor elements into the DOM as part of its capture routine. The npm entry points are cover: dist/index.js only re-exports trivial modules, and CasamareListingService.load() in dist/listing/service.js reads dist/assets/5760.pbf and returns it base64-encoded as an "application/x-protobuf" listing resource, which is how the payload is delivered to a consuming app. The package declares no bin, no install hook beyond a prepare build step, and contains no environment-variable or filesystem credential access — the theft is entirely of browser session material.