portal-backend@999.0.0

Analysis

portal-backend@999.0.0 is a dependency-confusion package impersonating an internal service. The preinstall hook runs postinstall.js which collects the following from the installation environment: hostname, username, current working directory, npm registry/prefix configuration, and every environment variable whose name matches key|secret|token|pass|private|ssh|deploy|auth|api|rpc|wallet|sentry|docker|graph|slack|host (harvesting API keys, tokens, passwords, and other secrets). This collected data is serialized as JSON and POSTed over HTTPS to 185[.]130[.]46[.]35:8443/collect. Errors from both the data collection and the network request are silently swallowed (the preinstall script uses `|| true` and an empty catch block), making the attack invisible during installation.