ts-bn-proto@5.8.1

Analysis

When installed, the package's postinstall script (node test.js) immediately executes four credential-harvesting routines without user consent. It scans the home directory, all drive roots (Linux /home, Windows C:\, macOS /Users), and the current working directory for sensitive files including .env files, JSON wallet files (id.json), config.toml, and any files whose names contain wallet/key/seed/mnemonic/private_key/keystore/metamask/phantom/trezor/ledger keywords. It also collects shell command histories from ~/.bash_history, ~/.zsh_history, ~/.local/share/fish/fish_history, and PowerShell ConsoleHost_history.txt across platforms. On Windows and macOS, it steals the Telegram Desktop session directory (tdata) by gzipping the entire folder. All stolen data is exfiltrated via multipart HTTP POST requests to hxxps://data-stream[.]space/api/v1. The exfiltration server endpoint can be overridden by the BACKUP_API_URL environment variable.