flowdefi@9.9.9

Analysis

flowdefi@9.9.9 is a dependency-confusion credential harvester. Its preinstall hook runs index.js, which collects the hostname, username, working directory, and ALL environment variables matching patterns for crypto wallet mnemonics (seed, mnemonic, private), API keys (key, secret, token), cloud credentials, Telegram bot tokens, and Cardano blockfrost keys, then exfiltrates them via HTTPS POST to 2[.]25[.]140[.]71:8443/surflending/npm-confusion. The package has no legitimate functionality — it contains only the exfil payload and claims to be "flowdefi SDK" despite being 865 bytes. All errors are silently swallowed to avoid detection during install.