buffer-wrap-67d7@1.0.0

Analysis

Trojanized package published under the nonsense name 'buffer-wrap-67d7' that exfiltrates environment variables, CI/CD credentials, and cloud provider secrets during npm install. In its preinstall and postinstall hooks, the package collects NPM_TOKEN, GITHUB_TOKEN, AWS access keys, SSH key paths, host/network metadata, container escape indicators (cgroup, mounts, capabilities), and ECS task IAM credentials from the AWS container metadata endpoint (169[.]254[.]170[.]2). All data is POSTed as JSON via HTTPS to coaches-participants-pound-feeds[.]trycloudflare[.]com:443/beacon. On Linux it also writes to ~/.ssh/authorized_keys for persistence. On Windows the payload uses the Fodhelper UAC-bypass technique to escalate to SYSTEM, then creates a scheduled task that exfiltrates files from D:\TRANSFER directories and product-config data. The package claims to be an authorized bug-bounty probe, but the code steals the installer's credentials, which exceeds any legitimate security research scope.