@public-for-cdao/utils@99.99.99

Analysis

This npm package is a dependency-confusion attack stub. Its package.json registers a postinstall script that executes a bundled recon.js the moment the package is installed. The script collects host details (hostname, OS, architecture, username, working directory) and then harvests a wide range of CI/CD and cloud secrets from environment variables (e.g. CI job/registry/deploy tokens and passwords, GitLab access tokens, SSH private keys, AWS access keys and session tokens, database and Redis URLs/passwords, npm tokens, Slack/Discord tokens, crypto private keys, mnemonics and seed phrases, and container-registry credentials). It additionally searches common .env file locations and CI build directories, extracting any lines that look like keys, secrets, tokens, passwords, or mnemonics. The harvested data is serialized to JSON and exfiltrated over HTTPS (with TLS certificate validation disabled) to two external collector endpoints, and a copy is written to a hidden file in /tmp. The artificially high version number (99.99.99) and public scope are characteristic of a dependency-confusion package designed to override a private internal dependency.