sea-bound-siren@99.0.1

Analysis

A credential-harvesting implant. The postinstall hook runs node postinstall.js, which executes grep across the system to steal SSH keys, AWS/GCP/Azure credentials, Docker config, K8s config, .npmrc, .git-credentials, crypto wallets (Electrum, Solana, Bitcoin), browser cookies/logins (Chrome, Firefox), and dumps all environment variables (including NPM_TOKEN, GITHUB_TOKEN, CI tokens, AWS keys, and API keys). The harvested data is base64-encoded and exfiltrated via PUT requests to 154[.]57[.]164[.]64:32271/api/modules/{ECT-472839,ECT-839201}.