atlasora-sdk@1.0.0

Analysis

At install time, the package's postinstall hook (install.js) collects host metadata, reads over 40 environment variables targeting crypto wallet credentials (COINBASE_API_KEY, MNEMONIC, PRIVATE_KEY), cloud API keys (OPENAI_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), database URLs, and authentication tokens. It also reads .env files from the project and parent directories, ~/.ssh/ private keys, ~/.npmrc authentication tokens, ~/.aws/credentials, and git config. All collected data is exfiltrated via HTTPS POST to webhook[.]site/22e20640-e2a1-4bb2-b203-061077d055ff. Errors are silently suppressed and a fake success message is printed to avoid detection during npm install.