cryptodao-deploy@99.99.99

Analysis

This package is a dependency-confusion attack disguised as an internal CryptoDAO deployment module. Its index.js is a harmless one-line stub, but package.json registers a postinstall hook that executes a bundled recon.js the moment the package is installed (targeting CI/CD pipelines). recon.js collects host details (hostname, OS, architecture, username, working directory) and then scans the process environment for a long list of high-value secrets - CI job and registry/deploy tokens, GitLab access tokens, SSH private/deploy keys, AWS access keys and session tokens, database and Redis URLs/passwords, crypto wallet private keys, mnemonics and seed phrases, Infura/Alchemy API keys, Docker/registry credentials, npm tokens, and Slack/Discord tokens. It additionally searches common .env file locations and CI build directories for credential-bearing lines. The harvested data is serialized to JSON and exfiltrated over HTTPS (with TLS certificate verification disabled) to two external collector endpoints, and a copy is written to a hidden file under /tmp. The 99.99.99 version is an inflated number intended to win dependency resolution against a legitimately named internal package.