@public-for-cdao/contracts@99.99.99

Analysis

A scoped npm package published at version 99.99.99 (a dependency-confusion lure designed to shadow an internal package of the same name) that runs a credential-harvesting payload from a postinstall hook. On install the payload collects host details (hostname, platform, architecture, username, working directory) and then reads a broad allowlist of CI/CD, cloud, and crypto secrets from environment variables (e.g. CI job/registry tokens, GitLab access tokens, SSH private keys, AWS access/secret/session keys, database and Redis URLs/passwords, NPM tokens, Docker/Harbor credentials, and blockchain PRIVATE_KEY/MNEMONIC/SEED_PHRASE and Infura/Alchemy API keys). It additionally searches common .env file locations and GitLab-runner build directories for lines containing key/secret/token/password/mnemonic material. The harvested data is serialized to JSON and exfiltrated over HTTPS (with TLS verification disabled) to two attacker-controlled collection endpoints, and a copy is written to a temp file. The package has no legitimate functionality.