wime-zle@1.1.4

Analysis

wime-zle@1.1.4 ships J2TEAM-obfuscated JavaScript in package/index.js that searches the installer's working directory for sensitive files — .env, id.json, Config.toml, and config.toml — and exfiltrates them via HTTP POST to hxxps://chalk-logger[.]vercel[.]app/api/validate. Each file is prefixed with the victim's $USER environment variable and local IP address as metadata before exfiltration. The package uses axios as the HTTP transport and a udp4 socket to 8[.]8[.]8[.]8:80 to determine the local IP. There are no lifecycle hooks; exfiltration triggers when the test script runs (npm test) or when the from_str() function is called.