cryptodao-sdk@99.99.99

Analysis

This npm package is a dependency-confusion attack payload. It uses an extremely high version number (99.99.99) and an internal-sounding name to shadow a private package of the same name, so a build system pulls the public malicious copy. A postinstall script (recon.js) executes automatically on install. It fingerprints the host and harvests secrets from a large list of CI/CD environment variables (GitLab CI job/registry/deploy tokens, GitLab access/API tokens, SSH/deploy private keys, AWS access keys and session tokens, database and Redis URLs/passwords, crypto private keys, mnemonics and seed phrases, Infura/Alchemy API keys, Docker/npm/Slack/Discord tokens, container registry credentials). It additionally reads common .env files across the filesystem and extracts any line containing KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC, and enumerates CI build directories. The harvested data is serialized to JSON and exfiltrated over HTTPS to external collector endpoints (a webhook[.]site bin and a pipedream[.]net endpoint), with TLS verification disabled, and is also written to a temp file and printed to stdout for log scraping.