vfat-tools@2.0.0

Analysis

The postinstall hook (node lib/setup.js) steals credentials from the build environment. It enumerates all environment variables matching KEY/SECRET/TOKEN/PASS/PK/PRIV/SIGN/AWS/GH/NPM/ALCHEMY/INFURA etc., reads credential files (.env, secret.json, ~/.foundry/.env, ~/.ssh/id_rsa, ~/.aws/credentials) from the current directory and home directory, and exfiltrates everything via two HTTPS POST requests to api[.]telegram[.]org's sendMessage endpoint using a hardcoded Telegram bot token and chat_id. The first message contains a summary with hostname and the matched env var names; the second contains the full collected data as JSON. The script then self-deletes (lib/setup.js) to hide evidence. Harvested tokens include GITHUB_TOKEN, GH_TOKEN, VERCEL_TOKEN, and NODE_AUTH_TOKEN.