ts-enum-helper@1.0.0

Analysis

Postinstall hook runs a shell script that harvests GCP OAuth tokens from the instance metadata server (metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token) and exfiltrates them to aaronstack[.]com/jules-collect. It then uses the stolen token to probe the Kubernetes API server (kubernetes.default.svc) — listing clusterrolebindings, nodes, secrets (in kube-system, apps, default, kube-public, kube-node-lease, and malysis namespaces), configmaps, deployments, daemonsets, statefulsets, persistentvolumes, jobs, and ingresses — and runs SelfSubjectAccessReviews to map the token's RBAC permissions. It also enumerates ~25 hardcoded GCS buckets (including "npm-analysis", "sd-malysis", "malysis-packages", "rare-signer-437603-p9-*"). All reconnaissance results are exfiltrated to the same endpoint (aaronstack[.]com/jules-collect) with distinct x-source headers (malysis-sysauth-token, malysis-sysauth-results, malysis-sysauth). The script gates on the MALYSIS_ANALYSIS_ID environment variable. The rest of the package is a 21-byte stub (module.exports = {};).