@public-for-cdao/common@99.99.99

Analysis

This scoped npm package is a dependency-confusion credential stealer. Published at the synthetic version 99.99.99 and described as for internal use, it shadows a presumably-private internal package so that a misconfigured installer pulls it from the public registry instead. Its package.json runs a postinstall hook (node recon.js) that executes automatically on install. The payload harvests secrets from the environment, targeting a large allowlist of CI/CD variables including GitLab job/deploy/registry tokens and access tokens, SSH and deploy private keys, AWS access/secret/session keys, database and Redis URLs and passwords, crypto private keys/mnemonics/seed phrases, Infura/Alchemy API keys, and Docker/NPM/Slack/Discord/Harbor credentials. It also reads .env files from many common locations (including /root and the GitLab runner home), extracts lines containing KEY/SECRET/TOKEN/PASS/PRIVATE/MNEMONIC, gathers host and user reconnaissance, and lists GitLab runner build directories. The collected data is exfiltrated over HTTPS (with TLS certificate validation disabled) to a webhook[.]site collector and a pipedream[.]net endpoint, and a copy is written to a temp file. The package main module is a one-line stub with no real functionality, present only to appear legitimate.