period-newline@0.1.0

Analysis

period-newline@0.1.0 poses as a tiny text formatter (inserts newlines after periods) but ships a malicious postinstall hook (dist/index5_test.js). On install, the hook: (1) self-deletes and overwrites package.json with a dummy — evasion; (2) AES-256-CTR decrypts embedded payload strings revealing a TCP C2 endpoint, credential-target paths, and an AES-GCM encryption key; (3) reads ~/.ssh/id_rsa, ~/.aws/credentials, ~/.docker/config.json, ~/.npmrc, ~/.netrc, Chrome Login Data, .env files, and git history; (4) collects hostname, username, and external IP from api[.]ipify[.]org; (5) encrypts all stolen data with AES-GCM and exfiltrates over TCP to the C2. Publisher ([account] The legitimate-looking README and CLI are a decoy for a full credential-theft implant.