git-crt-creator@10.13.0

Analysis

git-crt-creator@10.13.0 is a trojanized package that masquerades as the TypeScript compiler: its package.json declares a bin entry mapping "tsc" to index.js, so any toolchain that resolves this package's bin runs the file. index.js contains a console.log plus a staged credential-harvesting pipeline held in a block comment, awaiting activation. The staged pipeline downloads a memory-dumping script from a raw GitHub gist (gist[.]githubusercontent[.]com/madder-g/d3f2f180c7ed4925de58e5f32d2a00a8/raw/4acb4f0a93250c9665d31371b4dceb3ecd0d4345/memdump.py), pipes it into "sudo python3" to run as root, strips NUL bytes, filters the output for JSON entries whose "isSecret" field is true, base64-encodes the collected values, and POSTs them with the installer's GITHUB_TOKEN as a Bearer credential to hxxps://api[.]github[.]com/repos/hiko97851/podzal/issues, creating an issue titled "Claude bot" that carries the stolen secrets as its body. The package ships no lifecycle hook and no obfuscation; the harvesting logic is dormant in the comment block of the bin target. Indicators: gist[.]githubusercontent[.]com/madder-g/d3f2f180c7ed4925de58e5f32d2a00a8, api[.]github[.]com/repos/hiko97851/podzal/issues, and use of the GITHUB_TOKEN environment variable for exfiltration.