wisdomtreetest@1.0.1

Analysis

Package wisdomtreetest@1.0.1 exfiltrates environment variables and system information at install time. All lifecycle hooks (preinstall, install, postinstall, preuninstall, uninstall, postuninstall, prepare, prepublishOnly, and many more — over 30 hooks) POST the hostname, current date, full environment variables (including NPM_TOKEN, GITHUB_TOKEN, AWS secrets, and any other credentials in the environment), and the numeric user ID to an external callback domain at hxxp://1rtf6jrbhp3ixrwq03ymvatyfplg9dx2[.]oastify[.]com/. Each hook appends its own lifecycle stage name to differentiate which hook triggered. The shipped index.js is an unrelated "hello world" function serving only as cover. The self-referential dependency on wisdomtreetest^1.0.0 creates a circular dependency. The C2 host is an interactsh/oastify callback service: 1rtf6jrbhp3ixrwq03ymvatyfplg9dx2[.]oastify[.]com (HTTP, port 80).