spectral-core@3.0.5

Analysis

spectral-core@3.0.5 is a trojanized package that exfiltrates host and cluster data during npm install. The package declares `"scripts": {"install": "node-gyp rebuild"}` and `"gypfile": true` but ships no native source; the only purpose of the bundled package/binding.gyp is to run an action target ("run_postsetup") that invokes `node -e` with an inline payload. At install time that payload reads the files /fetch.sh, /run_test.sh, /setup_test.sh, /post_test.sh and /prepare_test.sh, executes `ls -laR /local/`, executes `ls -laR /var/run/secrets/` to collect the Kubernetes service-account token and mounted secrets, and reads /etc/hosts. It then concatenates the collected output and POSTs it as text/plain over HTTPS to hxxps://webhook[.]site/d6092bdc-05c0-45da-a280-c343ea6d6156. The package entry point index.js is a 62-byte stub (`module.exports = { name, version }`), so the install hook is the entire payload. Any host that installed this version should treat its Kubernetes service-account credentials and any secrets referenced above as compromised and rotate them, and block webhook[.]site egress.