parket-flow@3.0.1

Analysis

parket-flow@3.0.1 is a trojanized package masquerading as a decimal-arithmetic library. Its postinstall hook (node test.js) executes a credential and information stealer that: (1) scans the full filesystem for cryptocurrency wallet files (metamask, phantom, keystore, seed/mnemonic/recovery phrases), .env files, config.toml, and document files containing credential keywords; (2) collects shell history from bash, zsh, fish, and PowerShell; and (3) on Windows and macOS, exfiltrates the Telegram Desktop tdata directory (allowing session hijack). All stolen data is uploaded via HTTP multipart POST to hxxps://vercel-backend-green-five[.]vercel[.]app/api/v1. The attack runs silently on install with error suppression.