parket-helper@0.0.1

Analysis

Parket-helper@0.0.1 poses as a decimal-arithmetic library but is a credential and data-stealer. On npm install (postinstall hook), it: (1) scans the entire filesystem (Linux /home, macOS /Users, Windows C:\ drives) for wallet files (.env, keystore, seed-phrase files, private keys, mnemonic phrases, Metamask/Phantom credentials) and uploads them; (2) collects shell history from bash, zsh, fish, and PowerShell and uploads it; (3) on Windows and macOS, reads the Telegram Desktop tdata/ folder (containing session cookies and 2FA state) and uploads it as a gzip archive. All data is exfiltrated via multipart POST to parket-server-help[.]vercel[.]app/api/v1. Artifacts: index.js (18.6KB) contains the full stealer logic; test.js (509B) invokes it via postinstall.