test-leakage-attack-node@1.0.0

Analysis

The package exfiltrates all environment variables from the installer's machine via an HTTP GET request during npm install. The preinstall and postinstall hooks both run index.js, which collects every key-value pair from process.env, serializes them as JSON, base64-encodes the payload, and sends it to hxxp://somewhere[.]somehow[.]local/ in the X-Hidden request header. The exfiltrated data includes all environment secrets the victim has configured: API tokens, cloud credentials, database passwords, CI/CD tokens, and other sensitive configuration. The C2 host is somewhere.somehow.local (port 80, path /), and the exfiltration channel is the X-Hidden header on GET requests.