cryptodao-utils@99.99.99

Analysis

This package is a dependency-confusion attack disguised as an internal CryptoDAO utility module, published at version 99.99.99 to win resolution over a private package of the same name. Its package.json defines a postinstall hook that executes a bundled recon.js at install time. The script fingerprints the host (hostname, platform, architecture, username, working directory) and then harvests a broad set of CI/CD, cloud, and cryptocurrency secrets from environment variables, including GitLab CI job/deploy/registry tokens and passwords, GitLab access/API tokens, SSH private keys and deploy keys, AWS access/secret/session keys, database and Redis connection strings and passwords, NPM tokens, Docker and Harbor registry credentials, Slack/Discord tokens, RPC URLs, and wallet PRIVATE_KEY/MNEMONIC/SEED_PHRASE values. It also searches common .env file locations (including /app/.env, /home/gitlab-runner/.env, and /root/.env) and extracts lines matching key/secret/token/password/private/mnemonic patterns, and lists CI runner build directories. The collected data is serialized to JSON and exfiltrated over HTTPS (with TLS verification disabled) to two attacker-controlled endpoints, a webhook[.]site collector and a pipedream[.]net endpoint, and is also written to a temp file. The package provides no legitimate functionality; index.js is an empty stub.