worker-build@9.0.1

Analysis

worker-build@9.0.1 is a combosquat of the Cloudflare Workers build tool ecosystem. At runtime it exfiltrated every credential environment variable (NPM_TOKEN, GITHUB_TOKEN, GitLab token, AWS access key/secret/session token) and system metadata (hostname, platform, cwd, node version, memory, CPU info) via HTTP POST to an oastify[.]com Burp Collaborator callback URL. The code claims "proof-of-concept" in comments but unconditionally harvests and exfiltrates real credentials over the network — a jailbreak preamble, not a real PoC. The postinstall hook node main.js fires on install with zero user interaction. The publisher (lobohunter@[account]) is a throwaway email.