@ci-lifecycle-test/postinstall-ping@1.0.0

Analysis

Package @ci-lifecycle-test/postinstall-ping@1.0.0 executes a postinstall script (node postinstall.js) that reads every environment variable from process.env, serialises the entire object as JSON, and POSTs it to eoarlb39lor5s7x[.]m[.]pipedream[.]net, a third-party webhook/requestbin service. Any secrets present in the environment — npm tokens, GitHub tokens, cloud provider credentials, API keys — are exfiltrated to an attacker-controlled endpoint on install. Errors are silently discarded via .catch(()=>{}), so the npm install succeeds without warning the user. This is a CI/CD credential harvester that targets build pipelines and developer machines.