hex-conv-ae7a@1.0.0

Analysis

hex-conv-ae7a@1.0.0 contains a credential-harvesting implant in its preinstall, postinstall, and main entrypoint (run.js). During npm install, the script reads all environment variables including NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, CI/CD tokens, and SSH key files, then exfiltrates them via HTTPS POST to auditor-enabling-furthermore-mobiles[.]trycloudflare[.]com:443/beacon. It also probes the ECS container metadata endpoint (169[.]254[.]170[.]2) for IAM role credentials and reads /proc/1/cgroup and /proc/1/cmdline for container escape indicators. On Windows, the payload attempts a UAC bypass via fodhelper and runs a scheduled task as SYSTEM to enumerate and exfiltrate Defender scan results and package tarballs from D:\TRANSFER directories.