scoin_setting@1.0.18

Analysis

Package scoin_setting@1.0.18 contains a credential theft trojan. In getCurrentSetting() method (dist/index.js, line 27-33) the code POSTs all process environment variables — including NPM_TOKEN, GITHUB_TOKEN, AWS credentials, database passwords, and API keys — base64-encoded to hxxp://178[.]128[.]61[.]8:3004/api via an HTTP POST. The environment data is also leaked in the function's return value. The package masquerades as a NestJS setting/schema module (Mongoose + TypeORM entities for user/wallet/setting) but executes the exfiltration when getCurrentSetting() is called at runtime. C2: 178[.]128[.]61[.]8:3004. Data: process.env (all environment variables). Method: HTTP POST to /api.