cryptodao-contracts@99.99.99

Analysis

This package is a dependency-confusion credential-harvesting payload. Its package.json registers a postinstall script that runs recon.js automatically on install. The script fingerprints the host (hostname, OS, architecture, username, working directory) and then harvests a long hardcoded list of high-value secrets from environment variables, including CI/CD job and registry tokens, deploy credentials, SSH/deploy private keys, cloud access keys, database and cache connection strings/passwords, container-registry and package-registry tokens, chat tokens, and crypto secrets such as PRIVATE_KEY, MNEMONIC and SEED_PHRASE. It additionally searches for and reads common .env files in the project and on CI runners (including gitlab-runner and root home directories), extracting any lines containing key/secret/token/password/private/mnemonic, and enumerates CI build directories. The collected data is serialized to JSON and exfiltrated over HTTPS to two attacker-controlled collection endpoints (a webhook[.]site bucket and a pipedream[.]net endpoint), with TLS certificate verification disabled. A copy is also written to a temp file and captured ENV values are printed to the build log. The 99.99.99 version is chosen to outrank a legitimate internal package of the same name during resolution.