hemi-supply-cron@999.0.0

Analysis

The package hemi-supply-cron@999.0.0 runs a preinstall script (postinstall.js) on npm install. The script collects the hostname, current username, working directory, and environment variables matching secret-related keywords (key, secret, token, password, private, ssh, deploy, auth, api, rpc, wallet, sentry, docker, graph, slack, host) — including npm tokens, cloud API keys, and wallet credentials. The harvested data is exfiltrated via HTTPS POST to 185[.]130[.]46[.]35:8443/collect. Errors are silently suppressed. This is a dependency-confusion / version-squat package with a 1017-byte payload designed to steal installer credentials and secrets from CI and local environments.