ts-bn-lint@3.1.19

Analysis

Package index.js contains an info-stealer that walks the current working directory searching for Solana wallet key files (id.json), config.toml, Config.toml, config.json, .env, and env files. It also harvests shell history from ~/.bash_history, ~/.zsh_history, ~/.fish_history, ~/.sh_history, and PowerShell PSReadLine ConsoleHost_history.txt. All discovered files are exfiltrated via HTTP POST to hxxps://data-stream[.]space/api/v1 with a Content-Type: application/octet-stream header and Content-Disposition: attachment; filename="<filename>". Each exfiltrated payload is prefixed with the machine's USER environment variable and local IP address in the format USER@IP. When require()'d, the package automatically starts the search-and-exfil routine.