cryptodao-types@99.99.99

Analysis

A dependency-confusion package using an internal-sounding name and an absurdly high version (99.99.99) to win resolution. Its package.json sets a postinstall hook that runs a bundled recon.js at install time. The script collects host/OS information and the current user, then harvests a broad list of CI/CD and cloud secrets from the environment (e.g. GitLab CI job/API tokens, SSH/deploy keys, AWS access keys and session tokens, database and Redis credentials, wallet private keys/mnemonics/seed phrases, Infura/Alchemy keys, npm/Docker/registry credentials, RPC URLs). It additionally searches common .env file locations and CI build directories, extracting any lines containing key/secret/token/password/private/mnemonic material. The collected data is serialized to JSON and exfiltrated over HTTPS (with TLS certificate verification disabled) to two external collection endpoints, and a copy is written to a temp file. The published module code is an empty stub providing no real functionality.