@public-for-cdao/types@99.99.99

Analysis

A dependency-confusion package: it carries a trivial stub module but declares a postinstall script that runs a bundled reconnaissance payload at install time. The payload harvests host and environment data and aggressively collects CI/CD and cloud secrets — reading dozens of sensitive environment variables (GitLab job/registry/deploy tokens, SSH private keys, AWS access keys, database and Docker/Harbor credentials, npm tokens) and crypto secrets (private keys, mnemonics, seed phrases). It also searches the filesystem for .env files across common application and CI paths, extracting any lines containing key/secret/token/password material, and enumerates CI build directories. All collected data is JSON-encoded and exfiltrated over HTTPS to external collector endpoints (webhook[.]site and a pipedream[.]net endpoint, with TLS verification disabled), and a copy is written to a temp file. The high synthetic version number is used to win dependency-confusion resolution against a private internal package of the same name.