cryptodao-signer@99.99.99

Analysis

This package is a dependency-confusion attack stub. Its package.json defines a postinstall hook that executes a bundled recon.js script as soon as the package is installed. The script collects host details (hostname, OS, username, working directory) and then harvests a broad list of CI/CD and cloud credentials from environment variables, including GitLab job/registry/deploy tokens, SSH and deploy private keys, AWS access keys, database and Redis URLs/passwords, npm tokens, Docker/Harbor credentials, blockchain RPC API keys, and wallet private keys/mnemonics/seed phrases. It additionally scans many filesystem locations for .env files and extracts any lines containing secret-like keywords, and enumerates common CI build directories. The harvested data is serialized to JSON and exfiltrated over HTTPS (with TLS verification disabled) to two external collection endpoints (a webhook[.]site bin and a pipedream endpoint), and is also written to a temp file. The synthetic 99.99.99 version is chosen to outrank a legitimate internal package of the same name during resolution. The package has no legitimate functionality; index.js is an empty stub.