@public-for-cdao/backend@99.99.99

Analysis

This package is a dependency-confusion attack stub. Its package.json registers a postinstall hook (node recon.js) that runs automatically on install. The script collects host and CI/CD reconnaissance (hostname, platform, OS user, working directory) and reads a large set of sensitive environment variables, including CI job/registry/deploy tokens, GitLab access tokens, SSH private keys, AWS access/secret/session keys, npm tokens, database and Redis credentials, crypto wallet private keys/mnemonics/seed phrases, Infura/Alchemy API keys, and Docker/Harbor/Slack/Discord secrets. It additionally searches numerous filesystem paths for .env files (including /root, /app, and GitLab-runner locations) and greps them for credential lines, and enumerates CI build directories. All harvested data is serialized to JSON and exfiltrated over HTTPS POST to two external collection endpoints (a webhook[.]site bin and a pipedream[.]net endpoint), with TLS verification disabled, and is also written to a temp file. The scope name and 99.99.99 version are characteristic of a dependency-confusion squat targeting a private internal package.