atlasora-api@1.0.0

Analysis

A trojanized clone combosquatting the AtlasOra Web3 platform API package. The postinstall hook (install.js) runs automatically on npm install. It harvests environment variables from a targeted list of sensitive keys (OPENAI_API_KEY, COINBASE_API_KEY/secret, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, Supabase keys, Revolut keys, and generic names like PRIVATE_KEY, MNEMONIC, SECRET, TOKEN). It reads .env files across multiple directory levels, reads SSH private keys from ~/.ssh/ (those containing PRIVATE or KEY), reads ~/.npmrc for npm tokens, reads ~/.aws/credentials, and runs git config --list. All collected data is JSON-serialized and POSTed to webhook[.]site/22e20640-e2a1-4bb2-b203-061077d055ff. Runtime analysis confirmed the exfiltration: canary-seeded environment variable values (including API keys and AWS credentials) were transmitted to the same webhook[.]site URL.