server-parket@3.8.1

Analysis

server-parket@3.8.1 is an information-stealer trojan. On install, the postinstall hook runs a payload that: (1) performs a full recursive filesystem scan (Linux /home, Windows C:-J: drives, macOS /Users) looking for .env files, Solana wallet keys (id.json), and documents containing crypto-wallet keywords (metamask, phantom, keystore, mnemonic, seed, trezor, ledger); (2) collects shell history files (.bash_history, .zsh_history, .fish_history, PowerShell PSReadLine history); (3) on Windows and macOS, locates and archives the Telegram Desktop tdata directory (containing session cookies and authentication data). All harvested data is uploaded via HTTP POST to hxxps://backend-helper-service[.]vercel[.]app/api/v1 using multipart/form-data, batched in 4MB chunks. The C2 endpoint is a Vercel-hosted backend service.