ve-hemi-rewards@999.0.0

Analysis

This package is a dependency-confusion implant. Its preinstall script (postinstall.js) collects the installer's hostname, username, current working directory, and all environment-variable names matching key/secret/token/pass/private/ssh/deploy/auth/api/rpc/wallet/sentry/docker/graph/slack/host (harvesting credentials, API keys, and tokens from env), then POSTs the stolen data to 185[.]130[.]46[.]35:8443/collect via HTTPS. All errors are silently swallowed (|| true, empty try/catch) so installation succeeds without visible failure. The package ships only 3 files (758 bytes) and uses version 999.0.0 to maximize install priority over legitimate packages in dependency-resolution order.