@public-for-cdao/abi@99.99.99

Analysis

A dependency-confusion package that publishes a private-looking scoped name at an artificially high version (99.99.99) so it is preferred over an internal package of the same name. index.js is a one-line no-op stub; the real payload is recon.js, executed automatically via an npm postinstall hook. On install it harvests host/user details and a broad set of secrets from environment variables (GitLab CI job/registry/deploy tokens and passwords, GitLab access/API tokens, SSH private and deploy keys, AWS access/secret/session keys, database and Redis URLs/passwords, crypto private keys, mnemonics and seed phrases, Infura/Alchemy keys, Docker/NPM/Slack/Discord tokens, RPC URLs, Harbor credentials). It also searches a list of filesystem paths for .env files and extracts any lines containing KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC, and enumerates CI build directories. The collected data is POSTed over HTTPS (with TLS verification disabled) to two attacker-controlled endpoints (a webhook[.]site collector and a pipedream endpoint) and also written to a temp file. Targeted at CI/CD pipelines for credential theft.