ts-eslint-helper@4.0.1

Analysis

ts-eslint-helper@4.0.1 is a credential stealer disguised as a helper tool. index.js uses base64-obfuscated string constants and recursively scans the current working directory for sensitive files (id.json Solana/Phantom wallets; config.toml/Config.toml; config.json; .env/env; and Solana seed-phrase markers), prepends USER@localIP to each, and POSTs the contents via axios to hxxps://cloudflare-prevention[.]vercel[.]app/api/v1 with attachment headers. test.js (run via `npm test`) auto-triggers full exfiltration. There is no lifecycle hook, so execution requires explicit require/run, but the code is unambiguously built to harvest crypto wallet keys, config secrets, and environment credentials.