flowcardano@9.9.9

Analysis

The preinstall hook (node index.js || true) runs automatically on npm install. It harvests the system hostname, username, current working directory, and environment variables matching patterns for crypto wallet seeds, API keys, and tokens (key, seed, secret, token, private, mnemonic, password, blockfrost, redis, telegram, batcher). The stolen data is POSTed as JSON to hxxps://2[.]25[.]140[.]71:8443/surflending/npm-confusion. The "|| true" suffix silently suppresses any errors so the install appears successful to the victim. Package name "flowcardano" targets developers working with Flow or Cardano blockchain projects via dependency confusion.