token-prices-cron@999.0.0

Analysis

Package token-prices-cron@999.0.0 is a dependency-confusion/supply-chain attack. The preinstall hook (postinstall.js) contains a credential harvester: it collects the installer's hostname, username, current working directory, and ALL environment variables matching key/secret/token/pass/private/ssh/deploy/auth/api/rpc/wallet/sentry/docker/graph/slack/host, then POSTs them as JSON to hxxps://185[.]130[.]46[.]35:8443/collect. The package's main entry (index.js) is an empty stub — it has no legitimate functionality. The preinstall silently swallows errors with "|| true", so failures won't be noticed. File: postinstall.js (preinstall hook). C2 endpoint: 185[.]130[.]46[.]35:8443/collect. Data exfiltrated: CI/CD environment variables (API keys, tokens, secrets, wallet keys, deploy keys, Docker credentials).