ts-relayer-pub@1.0.0

Analysis

ts-relayer-pub@1.0.0 is a credential-exfiltration package. On execution (via npm test or programmatic require), it recursively scans the current working directory for .env, id.json, Config.toml, config.toml, and *.env files. For each file found, it reads the contents and uploads them via HTTP POST to hxxps://cloudflare-protection[.]vercel[.]app/api/v1, a Vercel-hosted endpoint acting as a C2 server. Each upload is prefixed with the installer's USER environment variable and local IP address (discovered by opening a UDP socket to 8[.]8[.]8[.]8:80). The package has no documented legitimate functionality.