delta-time-32bb@1.0.0

Analysis

The package runs a preinstall and postinstall hook (node run.js) that collects the full environment of the install target and sends it to a remote server. On Linux it reads all environment variables including GITHUB_TOKEN, NPM_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, SSH key paths, container metadata (/proc/1/cgroup, /proc/1/cmdline), network interfaces, Docker socket presence, and the ECS IAM credentials endpoint (169[.]254[.]170[.]2) — then POSTs the data to screw-daisy-powder-pirates[.]trycloudflare[.]com/beacon. It additionally attempts DynamoDB operations using the captured AWS task role. On Windows it locates and overwrites detection-verdict findings, then escalates to SYSTEM via fodhelper.exe and a scheduled task, exfiltrating system-context data to the same C2 host.