@public-for-cdao/deploy@99.99.99

Analysis

A dependency-confusion package using a high synthetic version (99.99.99) to shadow an organization internal module. Its package.json runs a postinstall hook (node recon.js) that executes automatically on install, including in CI/CD. The payload collects host details (hostname, OS, architecture, username, working directory) and then harvests secrets from the environment: a broad allowlist covering CI/CD job and deploy tokens, registry and Docker credentials, GitLab access/API tokens, SSH/deploy private keys, AWS access keys and session tokens, database and Redis URLs/passwords, crypto wallet private keys/mnemonics/seed phrases, RPC URLs and Infura/Alchemy keys, npm tokens, and Slack/Discord tokens. It also scans common .env file locations and CI build directories, grepping for credential-bearing lines. The harvested data is exfiltrated via HTTPS POST to two external collectors (a webhook[.]site endpoint and a pipedream[.]net endpoint, with TLS verification disabled) and is additionally written to a temp file. The packages main module is a harmless stub, confirming the package exists solely to run the reconnaissance and exfiltration payload.