eslint-helper@4.0.1

Analysis

This package is a credential and information stealer disguised as an ESLint helper. When invoked, it recursively scans the working directory for files named id.json (crypto wallet keys), .env and env (environment secrets), config.json, and config.toml, and reads bash, zsh, fish, sh, and PowerShell command history files. All collected data is exfiltrated via HTTP POST to hxxps://vercel-backend-rn1xzfaz~djbdhdfjjtj5-2167s-projects[.]vercel[.]app/api/v1 with Content-Type: application/octet-stream and the victim's USER env variable and local IP address as metadata prefix. The package name "eslint-helper" combosquats the ESLint tool to trick developers into installing it.