atlasora-client@1.0.0
Malicious code in atlasora-client (npm)
Analysis
A credential-harvesting package distributed as a trojanized npm module. The postinstall hook (install.js) runs automatically on installation and collects: environment variables (Coinbase API keys/secrets, Supabase service-role keys, OpenAI API keys, AWS credentials, Revolut API secrets, JWT secrets, mnemonic phrases, database URLs, and any env containing PRIVATE_KEY/SECRET/TOKEN); .env files from the package directory and two parent levels; SSH private keys from ~/.ssh/; the full ~/.npmrc file; ~/.aws/credentials; and git config output. All stolen data is exfiltrated via HTTPS POST to webhook[.]site/22e20640-e2a1-4bb2-b203-061077d055ff. Errors are silently suppressed so the install appears to succeed normally.
- analyzed by
- Leitwacht
- first seen
- Jun 20, 2026, 10:55 AM
- analyzed
- Jun 20, 2026, 10:57 AM
Related advisories
- kisama-js@0.1.8
- ts-bn-lint@3.1.19
- new-helper@5.8.1
- ts-big-ecro@3.8.1
- node-slot@1.0.7
- server-parket@3.8.1
- parket-helper@0.0.1
- tiny-string-parser@0.1.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.