ttspc-server-sample@9.0.0

Analysis

Credential-theft malware masquerading as a "worker-build PoC" package. The postinstall hook runs main.js, which collects host system information (hostname, platform, CPU count, memory, username, cwd) and steals environment-variable credentials targeting AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, NPM_TOKEN, GITHUB_TOKEN, GITLAB_TOKEN, and database connection strings. All of it is exfiltrated to an oastify[.]com (Burp Collaborator) callback host via HTTP POST to /exfil and /api/exfil, plus DNS exfiltration via dns.lookup.