cryptodao-core@99.99.99

Analysis

This npm package is a dependency-confusion attack: it is published under a synthetic high version (99.99.99) to override a private internal package of the same name, and it ships an empty stub module so it appears to do nothing useful. On installation it runs a postinstall script that harvests secrets from the environment and exfiltrates them. It collects host details (hostname, OS, username, working directory) and scans for a long list of CI/CD and cloud credentials in environment variables — including GitLab CI job/registry/deploy tokens, GitLab API tokens, SSH and deploy keys, AWS access keys and session tokens, database and Redis URLs/passwords, Docker and npm registry tokens, Slack/Discord tokens, container-registry credentials, and crypto-wallet material (private keys, mnemonics, seed phrases, Infura/Alchemy keys). It also reads common .env files across the project and CI runner home directories, extracting lines matching secret patterns, and enumerates CI build directories. The gathered data is sent over HTTPS (with TLS verification disabled) to two external collection endpoints and written to a temp file. There is no legitimate functionality.