@public-for-cdao/providers@1.0.1

Analysis

This package has no real functionality (its main module exports an empty object) and exists solely to run a credential-harvesting script at install time. A postinstall hook executes a bundled recon script that: collects host details (hostname, OS platform/arch/release, username, working directory, HOME); scans environment variables for names matching secret patterns (TOKEN, SECRET, KEY, PASS, PRIVATE, CREDENTIAL, SIGNER, RPC, WALLET, MNEMONIC, SEED, PK, AUTH, API) and captures their values; reads .env files from the current directory, parent directories, the home directory and the filesystem root; and shells out to read shell history (~/.bash_history, ~/.zsh_history), the git config, the first line of the SSH private key (~/.ssh/id_rsa), and the npm credentials file (~/.npmrc). The harvested data is JSON-encoded and sent via an HTTPS POST to a remote attacker-controlled endpoint, with TLS certificate validation explicitly disabled. The install hook swallows all errors so the theft is silent.