cryptodao-backend@99.99.99

Analysis

This package is a dependency-confusion attack payload. Its package.json registers a postinstall lifecycle hook that automatically runs a bundled script on install. That script performs credential reconnaissance: it collects host and OS details, then scrapes a wide list of CI/CD and cloud secrets from environment variables (e.g. GitLab CI job/deploy/registry tokens, GitLab access/API tokens, SSH and deploy keys, AWS access/secret/session keys, database and Redis URLs and passwords, crypto wallet private keys, mnemonics and seed phrases, Infura/Alchemy API keys, Docker and npm tokens, Slack/Discord tokens, and RPC URLs). It additionally searches and reads common .env files (including paths under /app, /home/gitlab-runner and /root) and extracts lines containing KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC, and enumerates CI build directories. The harvested data is serialized to JSON and exfiltrated over HTTPS POST to two external collector endpoints, with TLS verification disabled, and a copy is saved to a temp file. The extreme 99.99.99 version is set to win npm resolution over a private package of the same name. The package ships no real functionality.