@public-for-cdao/token@99.99.99

Analysis

This package is a dependency-confusion credential-harvesting payload. Its package.json declares a postinstall script that executes a bundled recon.js whenever the package is installed. On install the script collects host information (hostname, OS, architecture, current user, working directory) and then scrapes a broad list of CI/CD, cloud, and cryptocurrency secrets directly from environment variables, including GitLab job and deploy tokens, registry and deploy passwords, GitLab/NPM/Docker access tokens, SSH and deploy private keys, AWS access/secret/session keys, database and Redis URLs and passwords, wallet private keys, mnemonics and seed phrases, and Infura/Alchemy/RPC endpoints. It additionally searches a list of common .env file locations (including project roots, /app, and GitLab runner home directories) and extracts any lines containing key/secret/token/password/private/mnemonic, and enumerates CI build directories. The harvested data is serialized to JSON and exfiltrated over HTTPS (with TLS certificate validation disabled) to two external collector endpoints, and a copy is also written to a temp file. The scoped package name and inflated 99.99.99 version are consistent with a dependency-confusion attack targeting an internal private package of the same name. The shipped module entrypoint is a harmless stub, present only to make the package look legitimate.