@public-for-cdao/hooks@99.99.99

Analysis

This npm package is a dependency-confusion attack stub published at an extremely high version (99.99.99) to win resolution over an internal package of the same scope. Its package.json runs a postinstall script (node recon.js) that executes automatically on install. The recon.js payload performs credential reconnaissance and exfiltration: it gathers host and OS details, harvests a broad set of CI/CD secrets from environment variables (CI job/registry/deploy tokens, GitLab access/API tokens, SSH/deploy private keys, AWS access/secret/session keys, database and Redis URLs and passwords, blockchain wallet private keys/mnemonics/seed phrases, Infura/Alchemy API keys, npm/Docker/registry credentials, and RPC URLs), reads common .env files across the filesystem and extracts any lines containing secret-like keywords, and enumerates CI build directories. It then transmits the collected data as JSON over HTTPS to two external collection endpoints (a webhook[.]site bin and a pipedream[.]net endpoint), with TLS verification disabled, and also drops a copy to a temporary file. The package has no legitimate functionality; index.js is an empty stub.