ts-big-ecro@3.8.1

Analysis

ts-big-ecro@3.8.1 is a combosquat of the legitimate big.js library, published under the impersonating handle d.ani.el.laba.l.d.ivi.no. It contains no malicious code itself but declares a hard dependency on server-parket@^3.8.1, a credential-stealing package. Upon npm install, server-parket's postinstall hook executes and performs broad system scanning: it enumerates home directories on Linux (/home/*, $HOME), drives C-J on Windows, and /Users/* on macOS, recursively searching for cryptocurrency wallet files (keywords: sol, eth, btc, metamask, phantom, mnemonic, seed, trezor, keystore, private_key), .env files containing API keys and tokens, and configuration files (id.json, config.toml). It also reads shell history from .bash_history, .zsh_history, fish_history, and PowerShell ConsoleHost_history.txt. On Windows and macOS it packs and exfiltrates Telegram Desktop's tdata directory containing session credentials. All harvested data is uploaded as multipart/form-data to backend-helper-service[.]vercel[.]app/api/v1. The package was published and rapidly unpublished to evade detection.