ts-eslinter@1.0.0

Analysis

Package ts-eslinter@1.0.0 is a typosquat targeting eslint/typescript-eslint. Its main module (index.js) uses base64-obfuscated strings to conceal credential-theft behaviour: on import (or when the test script is executed), it recursively searches the working directory for Solana/Phantom wallet key files (id.json), configuration files (config.json, config.toml), and environment files (.env, env). Each found file is read, prepended with the system's USER environment variable and local IP address, and exfiltrated via HTTP POST to parker-server-help[.]vercel[.]app/api/v1 as an octet-stream attachment. IOCs: hxxps://parker-server-help[.]vercel[.]app/api/v1 — host: parker-server-help[.]vercel[.]app, path: /api/v1.