@public-for-cdao/api@99.99.99

Analysis

This npm package is a dependency-confusion attack payload targeting CI/CD pipelines. It publishes at version 99.99.99 to overshadow a private package of the same name and runs an install-time postinstall hook (node recon.js). On install the script harvests host details and a broad set of secrets: CI/CD credentials from environment variables (job/registry/deploy tokens, GitLab access tokens, SSH/deploy keys, AWS access keys and session tokens, database and Redis URLs/passwords, npm/Docker/Slack/Discord tokens) as well as crypto secrets (PRIVATE_KEY, MNEMONIC, SEED_PHRASE, Infura/Alchemy/RPC keys). It also reads .env files from many locations and greps them for key/secret/token/password lines, and enumerates GitLab runner build directories. The collected data is packaged as JSON and exfiltrated over HTTPS (with TLS verification disabled) to two external collector endpoints (a webhook[.]site bin and a pipedream[.]net endpoint), with a copy written to a temp file. The main module is a one-line decoy with no real functionality.