bodega-sdk@9.9.9

Analysis

bodega-sdk@9.9.9 is a dependency-confusion package that exfiltrates environment variables at install time. The preinstall hook (node index.js || true) runs a script that collects the hostname, username, current working directory, and all environment variables whose names match secret/key/token/mnemonic/password patterns, then POSTs them to 2[.]25[.]140[.]71:8443/surflending/npm-confusion. Errors are silently caught so the install does not fail and alert the user.