new-ts-helper@9.0.2

Analysis

Package new-ts-helper@9.0.2 is a credential-harvesting infostealer. Its index.js exports functions that, when called, recursively scan the working directory for credential and configuration files (id.json, config.toml, Config.Toml, config.json, .env, env, and git conflict markers "======") and collect shell history from ~/.bash_history, ~/.zsh_history, ~/.local/share/fish/fish_history, and PowerShell console history on both Windows and Linux. It also actively executes `bash -c history` and `zsh -c 'fc -l -1000'` to extract shell history. All collected files and shell history are uploaded via HTTP POST to hxxps://vercel-backend-five-vert[.]vercel[.]app/api/v1, with the data tagged by the USER environment variable and the machine's local IP address. The package's test.js script (run via `npm test`) immediately invokes the full exfiltration chain.