tiny-string-parser@0.1.2

Analysis

The postinstall hook at scripts/postinstall.js runs automatically on install. It probes the victim's filesystem for SSH private keys (~/.ssh/id_rsa, ~/.ssh/id_ed25519), AWS credentials (~/.aws/credentials), GitHub CLI tokens (~/.config/gh/hosts.yml), npm auth tokens (~/.npmrc), Docker credentials (~/.docker/config.json), Kubernetes config (~/.kube/config), and shell history (~/.zsh_history, ~/.bash_history). It reads file contents (up to 4KB per file) and extracts Chrome browsing history via sqlite3. It also harvests all environment variables whose names contain TOKEN, KEY, SECRET, PASSWORD, PASS, CREDENTIAL, AUTH, or API. All collected data is serialized as JSON and POSTed to the C2 endpoint hxxps://lovely-purpose-production[.]up[.]railway[.]app/pwned with a Bearer authorization token. The package evades detection by exiting immediately if RAILWAY_ENVIRONMENT or RAILWAY_PROJECT_ID is set (indicating a Railway CI environment).