metrics-probe-88ad@1.0.0

Analysis

This npm package executes a bundled run.js via both preinstall and postinstall lifecycle hooks, so the payload runs automatically on installation, with no import required. On Linux/CI hosts it harvests a broad set of secrets and metadata: AWS ECS task-role IAM credentials (AccessKeyId, SecretAccessKey, session Token) retrieved from the container credentials endpoint at 169[.]254[.]170[.]2, env-injected AWS access keys, CI/CD tokens (GITHUB_TOKEN, NPM_TOKEN, GitHub Actions OIDC and runtime tokens/URLs), SSH key file metadata under /root/.ssh and /home/runner/.ssh, ECS task metadata (cluster and task ARN), and container-escape reconnaissance (/proc/mounts, process capabilities, docker socket presence, entrypoint scripts). Using the stolen ECS role it then makes live AWS DynamoDB calls (list/describe tables and a put_item that writes a marker row), and exfiltrates the full collected payload via an HTTPS POST to an attacker-controlled Cloudflare quick-tunnel endpoint on port 443. On Windows it overwrites a findings XML file with tampered content and performs a fodhelper-based UAC bypass that registers a SYSTEM-level scheduled task to run reconnaissance commands, exfiltrating the output to the same remote endpoint. The package presents itself as authorized security research, but it auto-executes on install, steals real credentials, mutates a live database table, and sends everything to an anonymous external tunnel.