hemi-earn-actions@999.0.0

Analysis

hemi-earn-actions@999.0.0 is a dependency-confusion package that exfiltrates credentials during npm install. Its preinstall script runs postinstall.js, which collects the system hostname, username, current working directory, and all environment variables matching credential-related patterns (key, secret, token, pass, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, slack) along with npm registry configuration. The collected data is POSTed via HTTPS to 185[.]130[.]46[.]35:8443/collect. The install script suppresses errors with `|| true` and the payload wraps the exfiltration in a try/catch block to avoid detection. Runtime analysis confirmed the DNS queries and HTTPS POST to this external host.