eslint-helper-1@5.0.4

Analysis

eslint-helper-1@5.0.4 ships an information stealer disguised as an ESLint helper. The package contains index.js which searches the current working directory and parent directories for credential files — including Solana CLI wallet keys (id.json), .env files, config.json, and config.toml — and collects shell command history from bash, zsh, fish, and PowerShell (on both Windows and Linux). All stolen files and history are exfiltrated via HTTPS POST with Content-Type: application/octet-stream to hxxps://vercel-backend-five-vert[.]vercel[.]app/api/v1. The package also resolves the victim's local IP address via a UDP DNS socket to 8[.]8[.]8[.]8:80, which is prepended to exfiltrated payloads as a username@ip prefix. The test.js entry point triggers the full exfiltration chain immediately when executed. The package has no lifecycle hooks (it does not auto-execute on npm install), but contains all the code required for credential theft and exfiltration.