maninos@1.2.0

Analysis

A decoy TypeScript demo package ('A demo package for Total TypeScript') with a malicious postinstall script. The postinstall reads /proc/self/environ (all process environment variables), greps for 'ingehack', and passes the result as a query parameter via wget to s450r1[.]alwaysdata[.]net/inge/logger.php — targeted environment-variable exfiltration aimed at specific CI/deployment secrets. The actual package code is trivial (an 'add(a,b)=>a+b' function with stubs). ATT&CK: T1552.001 (env var harvest), T1059.007 (postinstall execution), T1071.001 (HTTP exfil to alwaysdata[.]net), T1041 (exfiltration).