mypocmaliciouspackage-cursorpt1@4.0.0

Analysis

The preinstall script steals GCP metadata service-account credentials: it curls hxxp://metadata[.]google[.]internal/computeMetadata/v1/instance/service-accounts/230183572078-compute/token with the Metadata-Flavor: Google header, captures the token, then POSTs it to hxxps://webhook-test[.]com/600362a259dbe7e193c2f8508876ab18 — cloud metadata credential theft and exfiltration. The package has no code files (just package.json, ~416 bytes), consistent with a payload-only namespace-claim attack.