stream-read-35cf@1.0.0

Analysis

The npm package stream-read-35cf@1.0.0 is a trojanized credential-theft implant. During npm install, the preinstall and postinstall lifecycle hooks execute run.js, which collects and exfiltrates CI/CD credentials and environment variables to a remote host. The payload captures GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and environment variable names for over 60 provider services (Anthropic, OpenAI, GitHub, GitLab, Slack, Stripe, Twilio, Vercel, Netlify, DigitalOcean, npm, Hugging Face, SendGrid, Cloudflare, Docker, PyPI, Cargo) from the build environment. It also queries the ECS metadata endpoint (169[.]254[.]170[.]2) to steal AWS IAM role credentials and reads SSH private keys from common paths. All collected data is POSTed as JSON over HTTPS to issue-clothing-medicine-archive[.]trycloudflare[.]com:443/beacon across three phases (preinstall, postinstall, and require). On Windows, the payload additionally executes a UAC bypass via the fodhelper registry key (HKCU\Software\Classes\ms-settings\Shell\Open\command) to run a PowerShell script as SYSTEM via a scheduled task, which exfiltrates and tampers with Microsoft Defender ATP findings and workflow logs from D:\TRANSFER.